Sagi Dinar

**Name of the Vulnerable Software and Affected Versions** Taiga version 6.8.1 **Description** A CSV injection issue allows attackers to execute arbitrary code via uploading a crafted CSV file. This is achieved by loading a specifically manipulated CSV file, enabling the execution of arbitrary code. **Recommendations** For Taiga version 6.8.1, consider disabling the CSV upload feature until a patch is available to prevent exploitation. Restrict access to areas where CSV files can be uploaded to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Taiga version 8.6.1 **Description** A Client-Side Template Injection (CSTI) issue in the /project/new/scrum component allows remote attackers to execute arbitrary code by injecting a malicious payload within the new project details. **Recommendations** For Taiga version 8.6.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Taiga version 6.8.1 **Description** The issue allows attackers to redirect users to arbitrary websites by appending a crafted link to the `/login?next=` parameter in the login page URL. This can potentially lead to unauthorized access. **Recommendations** For Taiga version 6.8.1, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the `/login` endpoint or validating the `next` parameter to prevent redirects to unauthorized websites.