CVE-2026-14752: mjperpinosa stumasy XSS Vulnerability

CVE-2026-14752 Overview

CVE-2026-14752 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in the mjperpinosa/stumasy project. The flaw resides in the add_definition function of application/PHP/objects/notes/add_into_dictionary.php, where the reference argument is not properly sanitized before being reflected back to the user. An authenticated remote attacker can inject arbitrary HTML or JavaScript through this parameter. The exploit has been publicly disclosed. Because stumasy follows a rolling release model, there are no discrete affected or fixed version identifiers. The project maintainer was notified through a public issue report but had not responded at the time of disclosure.

Critical Impact
Attackers can execute arbitrary JavaScript in the browser context of a targeted user, enabling session hijacking, credential theft, or unauthorized actions within the application.

Affected Products

mjperpinosa stumasy (all rolling releases up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be)
Affected file: application/PHP/objects/notes/add_into_dictionary.php
Affected function: add_definition

Discovery Timeline

2026-07-05 - CVE-2026-14752 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14752

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting weakness in a PHP-based note management component. The add_definition function accepts a reference parameter and inserts it into the output stream without applying HTML entity encoding or contextual escaping. When a victim renders the affected page, the browser interprets injected markup as executable content.

Exploitation requires low privileges and user interaction, and the attack can be delivered over the network. The impact is limited to integrity within the vulnerable web context; confidentiality and availability of the application backend are not directly affected. However, chained attacks may lead to session takeover of authenticated users, including administrators.

The project uses continuous delivery with no versioned releases, which complicates patch tracking. Consumers of the repository must pin to specific commits and audit upstream changes manually. EPSS data indicates a low probability of near-term exploitation at large scale, though public disclosure lowers the barrier to opportunistic abuse.

Root Cause

The root cause is missing output encoding on the reference argument passed to add_definition. The application reflects user-controlled input directly into HTML context without invoking htmlspecialchars, htmlentities, or an equivalent context-aware escaping routine.

Attack Vector

An authenticated attacker submits a crafted reference value containing script content through the dictionary addition workflow. When the value is rendered, the payload executes in the victim's browser under the origin of the stumasy application. Delivery typically requires the victim to visit a page that displays the poisoned entry, satisfying the user interaction requirement.

The vulnerability mechanism is described in prose only. See the VulDB Vulnerability Information and GitHub Issue Tracker for further technical detail.

Detection Methods for CVE-2026-14752

Indicators of Compromise

HTTP POST requests to add_into_dictionary.php containing <script>, onerror=, onload=, or javascript: tokens in the reference parameter
Database entries in the dictionary table containing HTML tags or JavaScript event handlers
Anomalous outbound requests from user browsers to attacker-controlled domains shortly after loading dictionary pages

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the reference parameter for HTML control characters and script keywords
Review application logs for POST requests to add_into_dictionary.php with unusually long or encoded parameter values
Perform static analysis of the PHP codebase to identify unescaped echoes of the reference variable

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts
Monitor authenticated session activity for unexpected privilege actions following dictionary page views
Log and alert on modifications to files under application/PHP/objects/notes/

How to Mitigate CVE-2026-14752

Immediate Actions Required

Restrict access to the stumasy application to trusted users until a fix is applied
Apply server-side input validation to the reference parameter, rejecting values containing HTML metacharacters
Enforce a strict Content Security Policy that disables inline scripts and unsafe evaluation

Patch Information

No official patch is available. The maintainer has not responded to the issue report filed at the GitHub Issue Tracker. Downstream operators should fork the repository and apply local fixes that call htmlspecialchars($reference, ENT_QUOTES | ENT_HTML5, 'UTF-8') before any output operation, and validate input on the server before persistence.

Workarounds

Place the application behind a reverse proxy with XSS filtering rules active on the reference parameter
Disable or gate the add-to-dictionary functionality for untrusted user roles
Sanitize existing dictionary records to remove any HTML or script content already stored

bash

# Configuration example
# Example NGINX rule to block script content in the reference parameter
if ($args ~* "reference=[^&]*(<script|onerror=|onload=|javascript:)") {
    return 403;
}