PT-2026-21329 · Openshift · Openshift

Mdavistffhrtporg · Publicado 2026-02-20 · Atualizado 2026-02-21 · CVE-2026-27169

Positive Technologies (AI Summary)

CVSS v3.1

8.9

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenSift versions 1.1.2-alpha and below

Description OpenSift is an AI study tool that utilizes semantic search and generative AI to process large datasets. The application renders untrusted user and model content in its chat tool user interface using unsafe HTML interpolation, resulting in a cross-site scripting (XSS) condition. Stored content can execute JavaScript when viewed in authenticated sessions. An attacker influencing stored study, quiz, or flashcard content could trigger script execution in a victim’s browser, potentially allowing actions to be performed as that user within the application session.

Recommendations Update to version 1.1.3-alpha or later.

Exploit

Correção

Improper Encoding or Escaping of Output

XSS

Enumeração de Fraquezas

CWE-116

CWE-79

Identificadores relacionados

BDU:2026-02354

CVE-2026-27169

GHSA-QRPX-7CMV-5GV5

Produtos afetados

Openshift

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27169.json · Exploit
• https://github.com/OpenSift/OpenSift/security/advisories/GHSA-qrpx-7cmv-5gv5 · Aviso do Fabricante
• https://github.com/OpenSift/OpenSift/releases/tag/v1.1.3-alpha · Nota
• https://bdu.fstec.ru/vul/2026-02354 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-27169 · Aviso do Fabricante
• https://t.me/cveNotify/152686 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2025154203463602434 · Publicação no Twitter
• https://t.me/CVEtracker/45334 · Publicação no Telegram
• https://twitter.com/CVEarity/status/2025186581959917568 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27169 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2025052616359551292 · Publicação no Twitter