CVE-2026-1493: LEX Baza Dokumentów DOM-Based XSS Flaw

CVE-2026-1493 Overview

LEX Baza Dokumentów is vulnerable to DOM-based Cross-Site Scripting (XSS) in the "em" cookie parameter. The application unsafely processes this parameter on the client side, allowing an attacker to execute arbitrary JavaScript in the context of the victim's browser. While an attacker requires the ability to set a cookie to perform a more severe attack, the vendor has acknowledged this as a vulnerability and released a security patch in version 1.3.4.

Critical Impact

Attackers can execute arbitrary JavaScript code in victims' browsers through manipulation of the "em" cookie parameter, potentially leading to session hijacking, credential theft, or malicious actions performed on behalf of authenticated users.

Affected Products

• LEX Baza Dokumentów versions prior to 1.3.4

Discovery Timeline

• 2026-04-30 - CVE CVE-2026-1493 published to NVD
• 2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-1493

Vulnerability Analysis

This DOM-based XSS vulnerability exists in LEX Baza Dokumentów, a document management solution from Wolters Kluwer. The flaw occurs because the application reads the "em" cookie parameter and processes it unsafely within client-side JavaScript code. When the cookie value is reflected into the DOM without proper sanitization or encoding, malicious JavaScript code can be executed in the victim's browser context.

DOM-based XSS differs from traditional reflected or stored XSS in that the attack payload is processed entirely on the client side. The malicious script never passes through the server, making it potentially harder to detect through traditional server-side security controls. In this case, the vulnerable code path reads from document.cookie and inserts the value directly into the page's DOM structure.

The attack requires the adversary to have the ability to set a cookie in the victim's browser, which typically requires either: a separate vulnerability, access to a subdomain, or user interaction through social engineering. The vendor evaluated this as a genuine security concern and remediated it in version 1.3.4.

Root Cause

The root cause is improper input validation and output encoding in client-side JavaScript code (CWE-79). The application reads the "em" cookie value and incorporates it into the DOM without proper sanitization, allowing JavaScript execution when malicious payloads are injected through the cookie parameter.

Attack Vector

The attack requires local access to set a malicious cookie value containing JavaScript code. When the victim's browser processes the page, the client-side code reads the tainted cookie value and renders it in the DOM, executing the attacker's payload. This attack vector requires user interaction, as the victim must visit or interact with the application after the malicious cookie has been set.

The exploitation mechanism involves injecting JavaScript code into the "em" cookie parameter. Since detailed technical examples are not available from verified sources, interested parties should consult the CERT Security Advisory for additional technical information about the vulnerability and exploitation mechanics.

Detection Methods for CVE-2026-1493

Indicators of Compromise

• Suspicious JavaScript payloads appearing in cookie values, particularly in the "em" parameter
• Client-side script execution errors or unexpected DOM modifications in browser console logs
• Unusual cookie manipulation attempts targeting LEX Baza Dokumentów applications

Detection Strategies

• Monitor web application firewalls for anomalous cookie values containing script tags or JavaScript event handlers
• Implement Content Security Policy (CSP) headers to restrict inline script execution and report violations
• Review client-side JavaScript for unsafe DOM manipulation patterns involving cookie data

Monitoring Recommendations

• Enable browser-based XSS protection headers and monitor for triggered protections
• Audit access logs for requests with unusual cookie patterns targeting LEX Baza Dokumentów
• Deploy endpoint detection solutions to identify malicious script execution in user browsers

How to Mitigate CVE-2026-1493

Immediate Actions Required

• Upgrade LEX Baza Dokumentów to version 1.3.4 or later immediately
• Implement Content Security Policy (CSP) headers to mitigate XSS impact
• Review and audit all client-side cookie processing code for similar vulnerabilities

Patch Information

The vendor has released a security patch addressing this vulnerability in version 1.3.4. Organizations running affected versions should upgrade immediately. For additional information about the fix, refer to the Wolters Kluwer LEX Baza Dokumentów product page.

Workarounds

• Implement strict Content Security Policy headers that disable inline script execution: script-src 'self'
• Configure HTTP-only and Secure flags on all cookies to limit client-side access
• Deploy web application firewall rules to filter suspicious cookie values containing script patterns

# Example CSP header configuration for Apache
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"

# Example CSP header configuration for Nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'" always;