PT-2026-21329 · Openshift · Openshift

Mdavistffhrtporg · Published 2026-02-20 · Updated 2026-02-21 · CVE-2026-27169

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenSift versions 1.1.2-alpha and below

Description OpenSift is an AI study tool that utilizes semantic search and generative AI to process large datasets. The application renders untrusted user and model content in its chat tool user interface using unsafe HTML interpolation, resulting in a cross-site scripting (XSS) condition. Stored content can execute JavaScript when viewed in authenticated sessions. An attacker influencing stored study, quiz, or flashcard content could trigger script execution in a victim’s browser, potentially allowing actions to be performed as that user within the application session.

Recommendations Update to version 1.1.3-alpha or later.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

BDU:2026-02354

CVE-2026-27169

GHSA-QRPX-7CMV-5GV5

Affected Products

Openshift

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27169.json · Exploit
• https://github.com/OpenSift/OpenSift/security/advisories/GHSA-qrpx-7cmv-5gv5 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02354 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27169 · Security Note
• https://github.com/OpenSift/OpenSift/releases/tag/v1.1.3-alpha · Note
• https://t.me/cveNotify/152686 · Telegram Post
• https://twitter.com/CVEnew/status/2025154203463602434 · Twitter Post
• https://t.me/CVEtracker/45334 · Telegram Post
• https://twitter.com/CVEarity/status/2025186581959917568 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2025052616359551292 · Twitter Post