PT-2026-6759 · Unknown · Orcastatllm-Researcher

Joyghoshs · Publicado 2026-02-06 · Atualizado 2026-02-06 · CVE-2026-24903

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OrcaStatLLM Researcher (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists in the Log Message within the Session Page of OrcaStatLLM Researcher. This allows attackers to inject and execute arbitrary JavaScript code into the browsers of those affected. The attack vector involves providing malicious research topic inputs. The application is an LLM-based research paper generator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-24903

GHSA-47WV-G894-82M4

Produtos afetados

Orcastatllm-Researcher

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24903.json · Exploit
• https://github.com/AlgoNetLab/OrcaStatLLM-Researcher/security/advisories/GHSA-47wv-g894-82m4 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-24903 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2019847336101396522 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-24903 · Nota de Segurança