---
id: "CVE-2026-105456"
kind: "vulnerability"
aliases: ["CVE-2026-105456"]
title: "RTIR: HTML scrubber bypass lets stored javascript links run in RT sessions"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["incident-response", "package", "rt", "rtir", "self-hosted"]
not_affected_if: ["incident-reports-queue-restricted", "rtir-not-installed", "rtir-patched"]
published_at: "2026-10-30T16:17:37+00:00"
first_seen_at: "2026-10-30T16:31:25+00:00"
updated_at: "2026-10-30T16:32:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105456", "first_seen_at": "2026-10-30T16:31:25+00:00"}]
---

# RTIR: HTML scrubber bypass lets stored javascript links run in RT sessions

RTIR, an add-on for Best Practical's RT ticketing system, loosens the HTML scrubber so any link containing a placeholder passes, including javascript: links. An attacker who can store HTML in a ticket, including an unauthenticated email to the Incident Reports queue, can get script to run in the session of any user who clicks the link and act with that user's RT permissions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether RTIR is installed on the RT instance, for example by looking for the RTIR plugin in the RT installation's installed extensions.
- Check the installed RTIR version against the fixed versions listed below.
- Check whether the Incident Reports queue accepts email from outside the organisation.

## Fix

- RTIR `5.0.11`
- RTIR `6.0.4`

## Timeline

- 2026-10-30T16:31:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105456

## From the sources

RTIR extends RT's HTML scrubber to allow an internal link
      placeholder, and the extension lets through any link that merely
      contains the placeholder, including links using the executable
      javascript: scheme. The change applies to the whole RT instance
      once RTIR is installed, not only to RTIR's own queues. Anyone who
      can add HTML content to a ticket on such an instance can store
      such a link. That includes an unauthenticated sender of HTML email
      to the Incident Reports queue, which RTIR opens to everyone by
      default. Script runs when a user clicks the link, in that user's
      session, and can act in RT with that user's authority.


This issue was fixed in version 5.0.11 and 6.0.4

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_