PT-2026-21366 · Isso · Isso

Byamb4 · Published 2026-02-21 · Updated 2026-02-24 · CVE-2026-27469

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Isso versions prior to 0afbfe0691ee237963e8fb0b2ee01c9e55ca2144

Description Isso, a lightweight commenting server written in Python and JavaScript, contains a stored Cross-Site Scripting (XSS) issue. The website and author comment fields are susceptible due to insufficient HTML escaping. Specifically, the website field was not properly HTML-escaped, leaving single and double quotes unescaped. This allows for injection of arbitrary event handlers, such as onmouseover or onclick, when the website value is inserted into a single-quoted href attribute via string concatenation. The comment edit endpoint (PUT /id/) and the moderation edit endpoint (POST /id//edit/) also lack proper escaping. Enabling comment moderation can raise the bar for exploitation, but does not fully mitigate the issue as a moderator activating a malicious comment would still expose visitors.

Recommendations Update Isso to version 0afbfe0691ee237963e8fb0b2ee01c9e55ca2144 or later.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

CVE-2026-27469

GHSA-9FWW-8CPR-Q66R

Affected Products

Isso

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27469.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-27469 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9fww-8cpr-q66r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27469 · Security Note
• https://github.com/isso-comments/isso/commit/0afbfe0691ee237963e8fb0b2ee01c9e55ca2144 · Note
• https://github.com/isso-comments/isso/security/advisories/GHSA-9fww-8cpr-q66r · Note
• https://github.com/isso-comments/isso · Note
• https://twitter.com/CVEnew/status/2025154173893857403 · Twitter Post
• https://twitter.com/_cvereports/status/2026344035065958640 · Twitter Post
• https://docs.python.org/3/library/html.html#html.escape · Note
• https://t.me/cveNotify/152709 · Telegram Post
• https://twitter.com/ByamB4/status/2025511906333835757 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2025190855921799353 · Twitter Post
• https://t.me/CVEtracker/45365 · Telegram Post