PT-2026-59208 · Pypi · Kiwi Tcms

Published 2026-07-13 · Updated 2026-07-13

OSV

CVSS v3.1

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

Summary

In Kiwi TCMS the fields TestCase.extra link and TestPlan.extra link were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don't validate will be reset to a null value.

Impact

Deployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a Content-Security-Policy header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.

Fix

Related Identifiers

PYSEC-2026-2551

Affected Products

Kiwi Tcms

References · 8

• https://osv.dev/vulnerability/PYSEC-2026-2551 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-55630 · Security Note
• https://github.com/kiwitcms/Kiwi · Note
• https://github.com/kiwitcms/Kiwi/releases/tag/v16.1 · Note
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-473p-56xx-vg67 · Note
• https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/24/kiwi-tcms-161 · Note
• https://github.com/advisories/GHSA-473p-56xx-vg67 · Note
• https://pypi.org/project/kiwitcms · Note