PT-2026-21841 · Bugsink · Bugsink

Byamb4 · Published 2026-02-25 · Updated 2026-03-02 · CVE-2026-27614

Positive Technologies · (AI Summary)

CVSS v3.1

9.3

Critical

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Bugsink versions prior to 2.0.13

Description Bugsink is a self-hosted error tracking tool affected by a stored cross-site scripting (XSS) issue. An unauthenticated attacker who can submit events to a Bugsink project can store arbitrary JavaScript in an event. This payload executes when a user views the affected Stacktrace in the web UI. The issue occurs because the pygmentize lines() function in theme/templatetags/issues.py:75-77 falls back to returning raw input lines when Pygments returns more lines than expected, and mark safe() is then applied unconditionally to these unsanitized lines. Since Data Source Name (DSN) endpoints are public, no account is needed to inject the payload. Successful exploitation requires the attacker to submit events to the project and an administrator to view the crafted event in the UI, allowing the attacker to execute JavaScript in the administrator’s browser and act with their privileges within Bugsink.

Recommendations Update Bugsink to version 2.0.13 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27614

GHSA-VP6Q-7M36-PQ3W

Affected Products

Bugsink

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27614.json · Exploit
• https://github.com/bugsink/bugsink/commit/e784d6aeb0d5f29b40c2779d2544c2b9ef097ee9 · Patch
• https://github.com/bugsink/bugsink/security/advisories/GHSA-vp6q-7m36-pq3w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27614 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vp6q-7m36-pq3w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27614 · Security Note
• https://github.com/bugsink/bugsink · Note
• https://github.com/bugsink/bugsink/releases/tag/2.0.13 · Note
• https://twitter.com/cracbot/status/2028425191970447423 · Twitter Post
• https://t.me/cveNotify/153094 · Telegram Post
• https://twitter.com/CVEnew/status/2026641370979402067 · Twitter Post
• https://twitter.com/CveTodo/status/2026500534794936714 · Twitter Post
• https://twitter.com/CveFindCom/status/2026502745293742147 · Twitter Post