Executive brief
Steedos Platform is an AI-native infrastructure platform for building enterprise applications. A reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint allows attackers to inject malicious JavaScript code through crafted URLs. Victims visiting these links could have their session credentials (X-Auth-Token) stolen, leading to account takeover and unauthorized access to enterprise data.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the /api/page/render endpoint that fails to properly escape user-supplied query parameters (schemaApi and data) before inserting them into inline script elements within the EJS template rendering. The endpoint is unauthenticated and accepts arbitrary query parameters which are passed directly into page schema without sanitization. An attacker can craft a malicious URL containing script-terminating sequences (e.g., </script><script>) to break out of the script context and execute arbitrary JavaScript. When a victim visits the crafted link, the injected script executes in their browser with their authentication context, allowing the attacker to steal sensitive tokens and session cookies. The vulnerable code is present through version 3.0.15-beta.47.
Affected products
- Steedos Platform through 3.0.15-beta.47
Timeline
- 2026-09-15: disclosed