Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)
Summary
In Kiwi TCMS the fields TestCase.extra_link and TestPlan.extra_link were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don't validate will be reset to a null value.
Impact
Deployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a Content-Security-Policy header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | kiwitcms | <= 12.4 | no fix |
References
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-473p-56xx-vg67
- https://github.com/kiwitcms/Kiwi
- https://github.com/kiwitcms/Kiwi/releases/tag/v16.1
- https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/24/kiwi-tcms-161
- https://pypi.org/project/kiwitcms
- https://github.com/advisories/GHSA-473p-56xx-vg67
- https://nvd.nist.gov/vuln/detail/CVE-2026-55630
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N- Weakness (CWE)
CWE-79- Platform
- Python (PyPI)
- Package
kiwitcms- Disclosed
- 06.07.2026
- Updated
- 11.10.2026 14:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2551 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-473p-56xx-vg67 - CC BY 4.0
Vulnerability history: kiwitcms
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 13
- First → latest
- 11.2022 07.2026
- Without a fix
- 3
- Exploited in attacks
- 0
Severity breakdown
- High 7
- Medium 3
- Low 3
Disclosures per year
- 2022: 1
- 2023: 9
- 2024: 0
- 2025: 0
- 2026: 3
-
Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase) this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.