PT-2026-56086 · Pypi · Kiwi Tcms

Published 2026-07-06 · Updated 2026-07-06 · CVE-2026-55630

OSV

CVSS v3.1

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

Summary

In Kiwi TCMS the fields TestCase.extra link and TestPlan.extra link were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don't validate will be reset to a null value.

Impact

Deployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a Content-Security-Policy header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-55630

GHSA-473P-56XX-VG67

Affected Products

Kiwi Tcms

References · 5

• https://osv.dev/vulnerability/GHSA-473p-56xx-vg67 · Vendor Advisory
• https://github.com/kiwitcms/Kiwi/releases/tag/v16.1 · Note
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-473p-56xx-vg67 · Note
• https://github.com/kiwitcms/Kiwi · Note
• https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/24/kiwi-tcms-161 · Note