CVE-2026-54049

Sakai Conversations has a Stored XSS Issue

Published

2026-08-24

Modified

2026-08-24

EPSS percentile

10%

Aliases

GHSA-w2x5-gv52-9ccv

Sources

github-advisory

Summary

### Summary The Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's `unsafeHTML()` directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post. ### Description The Conversations REST API endpoint `POST /api/sites/{siteId}/topics` accepts a `message` field in the JSON request body. The service layer (`ConversationsServiceImpl`) stores the message directly to the database (`conv_topics.MESSAGE`) without invoking `FormattedText.processFormattedText()` or any equivalent HTML sanitizer. The same issue affects post replies via `POST /api/sites/{siteId}/topics/{topicId}/posts` and comments stored in `conv_comments`. On the frontend, `SakaiTopic.js`, `SakaiPost.js`, and `SakaiComment.js` all render the `message` field using LitElement's `unsafeHTML()` directive: - `SakaiPost.js` lines 429, 432: `${unsafeHTML(this.post.message)}` - `SakaiTopic.js` line 679: `${unsafeHTML(this.topic.message)}` - `SakaiComment.js` line 148: `${unsafeHTML(this.comment.message)}` Unlike other Sakai tools (Announcements, Assignments, Resources) which call `FormattedText.processFormattedText()` before persisting user content, the Conversations implementation has no equivalent protection at storage time or render time. ### Proof of Concept **Setup:** Admin/instructor session on a site with the Conversations tool enabled (siteId `BELP_275K_7418`). **Step 1 - Inject XSS payload in topic:** ``` POST /api/sites/BELP_275K_7418/topics HTTP/1.1 Host: localhost:9107 Cookie: SAKAIID= Content-Type: application/json {"title":"XSS Test Topic","message":" ","type":"QUESTION","visibility":"SITE","draft":false} ``` Response: HTTP 200, `"message":" "` - raw HTML stored. **Step 2 - Verify stored in database:** ```sql SELECT TOPIC_ID, TITLE, MESSAGE FROM conv_topics WHERE TOPIC_ID='e4c599c2-bd32-4364-9cbd-a5c9c102edfb'; -- Result: MESSAGE = ``` **Step 3 - Inject XSS payload in post reply:** ``` POST /api/sites/BELP_275K_7418/topics/e4c599c2-bd32-4364-9cbd-a5c9c102edfb/posts HTTP/1.1 Host: localhost:9107 Cookie: SAKAIID= Content-Type: application/json {"message":" alert(document.cookie) ","siteId":"BELP_275K_7418"} ``` Response: HTTP 200, `"message":" alert(document.cookie) "` - raw script stored. **Step 4 - Verify in database:** ```sql SELECT POST_ID, MESSAGE FROM conv_posts WHERE POST_ID='e3cf7aed-c630-448a-89bb-27a8baacd269'; -- Result: MESSAGE = alert(document.cookie) ``` When any site member loads the Conversations view, the LitElement web component fetches the stored messages via the REST API and renders them with `unsafeHTML()`, causing the injected scripts and event handlers to execute. ### Impact An attacker with any site membership (student role or higher) can: - Perform actions on behalf of victims - Exfiltrate gradebook data and course content - In a university context with hundreds of students per course, a single malicious post can compromise all enrolled students simultaneously ### Status / timeline: - 2026-06-02: Fix committed to master (`2696b4b48cbef2e81512f52f84f7477adff78b27`) - Release pending.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-w2x5-gv52-9ccv