Live › vulnerability › CVE-2026-112289
Go to dashboardKoalixcrm through 1.14.0 renders task titles without escaping in Task.link_to_task(), so a staff user can store script in a task title. When an administrator opens the task changelist or change form, that script runs in their session and can be used to create a superuser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted Koalixcrm up to and including 1.14.0 where non-administrative staff users can create or edit tasks. Exposure depends on administrators opening the task pages, so instances where only trusted staff can write tasks carry less risk. Teams not running Koalixcrm can skip it.
No product ranges from the sources yet.
1.14.0link_to_task in the Task admin code of your installed copy to confirm the unescaped rendering is present1.14.0 once a fixed release is available; unknown which version carries the fixEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task(). Attackers can embed HTML or script that executes when administrators open the task changelist or change form, enabling actions like creating a superuser.
This page as .md · .json · in your agent: get_signal("CVE-2026-112289")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.