# CVE-2026-82838: Venueless SVG uploaded file XSS via missing Content Security Policy

Source: https://junglewise.ai/threats/cve-2026-82838-venueless-svg-uploaded-file-xss-via-missing-content-security  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82838 · Severity: info · CVSS 6.4 · Published 2026-08-31

Venueless is an open-source virtual event platform that allows users to upload content and attend online conferences. The default Docker image failed to properly restrict executable JavaScript in uploaded SVG files, allowing attackers to inject malicious scripts. A Content Security Policy has now been implemented to prevent this attack.

## Quick answers

**Is CVE-2026-82838 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82838 being exploited in the wild.

**How severe is CVE-2026-82838?** Informational severity, with a CVSS score of 6.4, published 31 August 2026.

**Which products and versions are affected?** Venueless Venueless before commit 7dff888.

**Is there a fix for CVE-2026-82838?** A patch was published on 2026-08-31: Fix applied at commit 7dff888 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82838 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82838?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cross-site scripting (XSS) issue stemming from inadequate Content Security Policy (CSP) configuration in the default Docker container. Uploaded SVG files could be delivered with executable JavaScript content, which would execute in users' browsers when viewing the files. This requires network access to the Venueless instance and low privileges (ability to upload SVG files). An attacker with upload access can inject malicious scripts that execute in the context of other users' sessions, potentially leading to session hijacking, data theft, or actions performed on behalf of the victim. The fix involves implementing a valid Content Security Policy to restrict script execution. The patch is available at commit 7dff888.

## Affected products

- Venueless Venueless before commit 7dff888

## Timeline

- 2026-08-31: disclosed: Advisory published on GitHub
- 2026-08-31: patched: Fix applied at commit 7dff888

## References

- [https://github.com/](https://github.com/)
- [https://github.com/venueless/venueless/security/advisories/GHSA-38wh-hqvm-xgfc](https://github.com/venueless/venueless/security/advisories/GHSA-38wh-hqvm-xgfc)