CVE-2026-105408 Overview
CVE-2026-105408 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Tuleap Enterprise Edition versions 17.0 through 17.5. An authenticated attacker can inject arbitrary JavaScript that executes in another user's browser session when the stored content is rendered. The flaw carries a scope change, meaning injected scripts can impact resources beyond the vulnerable component. Dassault Systèmes published a security advisory tracking the issue under this CVE identifier.
Critical Impact
Attackers with low-privilege access can execute arbitrary script code in a victim's authenticated browser session, enabling session theft, account takeover, and unauthorized actions within Tuleap.
Affected Products
- Tuleap Enterprise Edition 17.0
- Tuleap Enterprise Edition versions through 17.5
- Dassault Systèmes Tuleap deployments in the affected range
Discovery Timeline
- 2026-10-12 - CVE-2026-105408 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-105408
Vulnerability Analysis
The vulnerability is a stored XSS flaw in Tuleap Enterprise Edition. User-supplied input is persisted by the application and later rendered in another user's browser without sufficient output encoding or sanitization. Because the payload is stored server-side, exploitation does not require crafting a one-off link; any user who views the affected content triggers the injected script.
The CVSS vector indicates the attack is executed over the network, requires low privileges, and depends on user interaction such as viewing the poisoned resource. The scope change reflects that script execution in the victim's browser context can affect data and functionality beyond the originally vulnerable component, including authenticated session data and cross-origin resources accessible to the Tuleap application.
The EPSS probability currently sits at 0.203%, placing the CVE in the lower activity percentile. No public proof-of-concept or exploit code is listed, and the CVE is not tracked on the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is improper neutralization of input during web page generation, classified as [CWE-79]. Tuleap stores attacker-controlled content and later outputs it in an HTML context without applying context-appropriate escaping. When rendered, embedded <script> elements or event-handler attributes are parsed and executed by the victim's browser.
Attack Vector
An authenticated attacker submits crafted HTML or JavaScript into a field persisted by Tuleap. When a victim with an active session loads the page containing the stored payload, the browser executes the injected code under the Tuleap origin. The attacker can hijack sessions, exfiltrate CSRF tokens, perform actions as the victim, or stage further attacks against trusted integrated systems. See the 3DS Security Advisory CVE-2026-105408 for vendor-specific technical details.
Detection Methods for CVE-2026-105408
Indicators of Compromise
- Tuleap records containing HTML tags such as <script>, <iframe>, <svg>, or inline event handlers like onerror= and onload= in user-submitted fields.
- Outbound requests from user browsers to unexpected domains shortly after loading Tuleap pages, consistent with session or token exfiltration.
- Unexpected administrative actions performed under valid user sessions without matching user-driven workflow telemetry.
Detection Strategies
- Review Tuleap application logs for POST/PUT operations writing suspicious markup to issue trackers, wikis, comments, or document metadata.
- Deploy web application firewall rules that flag JavaScript sinks and HTML event-handler attributes submitted to Tuleap endpoints.
- Correlate browser telemetry and endpoint EDR data for anomalous script execution originating from the Tuleap domain.
Monitoring Recommendations
- Enable Content Security Policy (CSP) violation reporting to surface blocked script executions on Tuleap pages.
- Monitor authenticated session activity for geographic or device anomalies that may indicate stolen session cookies.
- Audit high-privilege account activity for unexpected configuration or permission changes following page views.
How to Mitigate CVE-2026-105408
Immediate Actions Required
- Upgrade Tuleap Enterprise Edition to a fixed release above 17.5 as published by Dassault Systèmes.
- Restrict account creation and limit submission permissions on Tuleap instances until patching is complete.
- Rotate active user session cookies and API tokens after upgrade to invalidate any sessions potentially captured through exploitation.
Patch Information
Refer to the vendor advisory for the fixed version and upgrade guidance: 3DS Security Advisory CVE-2026-105408. Apply the vendor-supplied patch across all Tuleap Enterprise Edition instances in the 17.0 through 17.5 range.
Workarounds
- Enforce a strict Content Security Policy on the Tuleap application to block inline script execution and unauthorized script sources.
- Deploy WAF signatures that strip or reject HTML and JavaScript payloads submitted to Tuleap input fields.
- Reduce the number of users with content-submission privileges until the patch is applied across the environment.
# Example Content Security Policy header to limit XSS impact
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; report-uri /csp-report
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
