{"id":"CVE-2026-129154","kind":"vulnerability","aliases":["CVE-2026-129154"],"related":[],"title":"SurveyKing: stored XSS lets anonymous respondents run scripts in admin browsers","description":"SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a respondent-supplied survey snapshot and the frontend renders its titles via innerHTML. Anonymous respondents can submit a forged snapshot embedding event handlers such as img onerror that execute in an administrator's browser session when the response is viewed.","summary":"SurveyKing 1.13.0 through 1.13.2 accepts a survey snapshot from respondents and renders its titles with innerHTML, so the page stores attacker-supplied markup. An anonymous respondent can embed event handlers such as img onerror that run in an administrator's browser session when a response is viewed.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","surveyking","web"],"not_affected_if":["no-admin-response-view","version-outside-range"],"how_to_check":"- Check the installed SurveyKing version; the affected range is `1.13.0` through `1.13.2`.","fix":null,"status":"open","published_at":"2026-11-13T18:17:39+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","triaged_at":"2026-11-13T18:51:46+00:00","updated_at":"2026-11-13T18:51:46+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T18:51:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SurveyKing: stored XSS lets anonymous respondents run scripts in admin browsers","impact":"medium","summary":"SurveyKing 1.13.0 through 1.13.2 accepts a survey snapshot from respondents and renders its titles with innerHTML, so the page stores attacker-supplied markup. An anonymous respondent can embed event handlers such as img onerror that run in an administrator's browser session when a response is viewed.","audience":"businesses","category":"other","nicknames":[],"who_cares":["surveyking","self-hosted","web"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"script runs in administrator's browser session","analyst_note":"Find the fixed version and any patch in the vulncheck advisory or NVD entry; the sources here do not state a fix.","how_to_check":"- Check the installed SurveyKing version; the affected range is `1.13.0` through `1.13.2`.\n- unknown for other checks, the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range","no-admin-response-view"],"who_is_affected":"Teams that self-host SurveyKing 1.13.0 through 1.13.2 and let anonymous respondents submit surveys are exposed, because the forged snapshot is stored and runs when an admin views responses. Instances on other versions, or where administrators do not view responses in a browser, are not shown to be affected by the sources.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4609,"output_tokens":558,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129154':14A,17A '-2026':13A,16A '1.13.0':25B,73C '1.13.2':27B,75C 'accept':28B,87C 'admin':10A 'administr':63B,120C 'anonym':5A,49B,102C 'attack':45B 'attacker-suppli':44B 'browser':11A,65B,122C 'contain':76C 'cross':80C 'cross-sit':79C 'cve':12A,15A 'emb':52B 'embed':109C 'event':53B,110C 'execut':117C 'forg':107C 'frontend':96C 'handler':54B,111C 'host':21B 'img':57B,114C 'innerhtml':39B,101C 'let':4A 'markup':47B 'onerror':58B,115C 'page':42B 'render':35B,97C 'respond':6A,33B,50B,90C,103C 'respondent-suppli':89C 'respons':69B,126C 'run':7A,60B 'script':8A,82C 'self':20B 'self-host':19B 'server':86C 'session':66B,123C 'site':81C 'snapshot':31B,93C,108C 'store':2A,43B,78C 'submit':105C 'suppli':46B,91C 'survey':30B,92C 'surveyk':1A,22B,24B,72C 'titl':37B,99C 'via':100C 'view':71B,128C 'vulner':83C 'web':23B 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host SurveyKing 1.13.0 through 1.13.2 and let anonymous respondents submit surveys are exposed, because the forged snapshot is stored and runs when an admin views responses. Instances on other versions, or where administrators do not view responses in a browser, are not shown to be affected by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","selfhosted","surveyking","web"],"campaign_type":null,"search_a":"'-129154':14A,17A '-2026':13A,16A 'admin':10A 'anonym':5A 'browser':11A 'cve':12A,15A 'let':4A 'respond':6A 'run':7A 'script':8A 'store':2A 'surveyk':1A 'xss':3A","search_b":"'1.13.0':25B '1.13.2':27B 'accept':28B 'administr':63B 'anonym':49B 'attack':45B 'attacker-suppli':44B 'browser':65B 'emb':52B 'event':53B 'handler':54B 'host':21B 'img':57B 'innerhtml':39B 'markup':47B 'onerror':58B 'page':42B 'render':35B 'respond':33B,50B 'respons':69B 'run':60B 'self':20B 'self-host':19B 'session':66B 'snapshot':31B 'store':43B 'suppli':46B 'survey':30B 'surveyk':22B,24B 'titl':37B 'view':71B 'web':23B","search_c":"'1.13.0':73C '1.13.2':75C 'accept':87C 'administr':120C 'anonym':102C 'browser':122C 'contain':76C 'cross':80C 'cross-sit':79C 'embed':109C 'event':110C 'execut':117C 'forg':107C 'frontend':96C 'handler':111C 'img':114C 'innerhtml':101C 'onerror':115C 'render':97C 'respond':90C,103C 'respondent-suppli':89C 'respons':126C 'script':82C 'server':86C 'session':123C 'site':81C 'snapshot':93C,108C 'store':78C 'submit':105C 'suppli':91C 'survey':92C 'surveyk':72C 'titl':99C 'via':100C 'view':128C 'vulner':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129154","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129154","severity":null,"published_at":"2026-11-13T18:17:39+00:00","modified_at":"2026-11-13T18:17:40+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","fetched_at":"2026-11-13T18:49:30+00:00","note":null}],"documents":[{"id":148612,"url":"https://www.vulncheck.com/advisories/surveyking-1.13.0-through-1.13.2-stored-xss-via-response-survey-snapshot","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}