PT-2026-6759 · Unknown · Orcastatllm-Researcher

Joyghoshs · Published 2026-02-06 · Updated 2026-02-06 · CVE-2026-24903

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OrcaStatLLM Researcher (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists in the Log Message within the Session Page of OrcaStatLLM Researcher. This allows attackers to inject and execute arbitrary JavaScript code into the browsers of those affected. The attack vector involves providing malicious research topic inputs. The application is an LLM-based research paper generator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-24903

GHSA-47WV-G894-82M4

Affected Products

Orcastatllm-Researcher

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24903.json · Exploit
• https://github.com/AlgoNetLab/OrcaStatLLM-Researcher/security/advisories/GHSA-47wv-g894-82m4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24903 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24903 · Security Note
• https://twitter.com/CVEnew/status/2019847336101396522 · Twitter Post