Is CVE-2026-91922 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91922 being exploited in the wild.

How severe is CVE-2026-91922?

Medium severity, with a CVSS score of 6.1, published 15 September 2026.

Which products and versions are affected?

Steedos Platform through 3.0.15-beta.47.

Is there a fix for CVE-2026-91922?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-91922 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-91922?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91922: Steedos Platform reflected XSS in /api/page/render endpoint

CVE-2026-91922 · Severity: medium · CVSS 6.1 · Published 2026-09-15

Steedos Platform is an AI-native infrastructure platform for building enterprise applications. A reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint allows attackers to inject malicious JavaScript code through crafted URLs. Victims visiting these links could have their session credentials (X-Auth-Token) stolen, leading to account takeover and unauthorized access to enterprise data.

Quick answers

Is CVE-2026-91922 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91922 being exploited in the wild.
How severe is CVE-2026-91922?: Medium severity, with a CVSS score of 6.1, published 15 September 2026.
Which products and versions are affected?: Steedos Platform through 3.0.15-beta.47.
Is there a fix for CVE-2026-91922?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-91922 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-91922?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in the /api/page/render endpoint that fails to properly escape user-supplied query parameters (schemaApi and data) before inserting them into inline script elements within the EJS template rendering. The endpoint is unauthenticated and accepts arbitrary query parameters which are passed directly into page schema without sanitization. An attacker can craft a malicious URL containing script-terminating sequences (e.g., </script><script>) to break out of the script context and execute arbitrary JavaScript. When a victim visits the crafted link, the injected script executes in their browser with their authentication context, allowing the attacker to steal sensitive tokens and session cookies. The vulnerable code is present through version 3.0.15-beta.47.

Affected products

Steedos Platform through 3.0.15-beta.47

Timeline

2026-09-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.