CVE-2026-15321: MyEMS XSS Vulnerability

CVE-2026-15321 Overview

CVE-2026-15321 is a cross-site scripting (XSS) vulnerability affecting MyEMS versions up to and including 6.4.0. The flaw resides in the on_post function within myems-api/core/svg.py, part of the Admin Backend component. Attackers can manipulate the new_values['data'] argument to inject arbitrary script content that executes in a victim's browser context. Exploitation requires high privileges and user interaction, and the attack can be launched remotely. The exploit code has been made public, increasing the likelihood of opportunistic abuse. MyEMS has released version 6.5.0, which addresses the flaw via commit 4a97edfbd786c779d0322054833b21ddf54d5b06. The associated GitHub issue remains open despite the availability of the official patch.

Critical Impact
Authenticated attackers with high privileges can inject persistent script payloads through the SVG admin endpoint, enabling session-context script execution against other administrators.

Affected Products

MyEMS versions up to and including 6.4.0
MyEMS myems-api/core/svg.py component (Admin Backend)
Fixed in MyEMS 6.5.0

Discovery Timeline

2026-07-10 - CVE-2026-15321 published to NVD
2026-07-10 - Last updated in NVD database
Patch commit - 4a97edfbd786c779d0322054833b21ddf54d5b06 merged into MyEMS 6.5.0

Technical Details for CVE-2026-15321

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. It exists in the on_post handler of myems-api/core/svg.py, which processes POST requests for SVG resources in the MyEMS Admin Backend. The handler accepts a new_values JSON payload and persists the data field without adequate output encoding or input sanitization. When another administrator later views the stored SVG content through the admin interface, the injected script executes in that user's browser session. The flaw enables session-context actions such as reading DOM content, issuing authenticated API requests, or pivoting to further administrative functions.

Root Cause

The root cause is missing neutralization of user-controlled input during web page generation. The new_values['data'] parameter is written to the backing store and later rendered without HTML or SVG-context escaping. SVG payloads are particularly effective vehicles for XSS because SVG supports embedded <script> elements and event handler attributes that browsers execute when the document is rendered inline.

Attack Vector

Exploitation is remote and network-based. An authenticated user with administrative privileges submits a crafted POST request to the SVG endpoint with a malicious payload in new_values['data']. Successful execution requires a second administrator to view the affected SVG resource, satisfying the user-interaction requirement. Because the exploit has been publicly disclosed, adversaries can adapt the technique against unpatched deployments.

Refer to the GitHub commit for the patch and the VulDB entry for CVE-2026-15321 for additional technical context.

Detection Methods for CVE-2026-15321

Indicators of Compromise

POST requests to the MyEMS SVG endpoint containing <script>, onload=, onerror=, or javascript: substrings within the new_values.data field.
Stored SVG records whose data column contains HTML event handlers or inline script blocks not consistent with legitimate diagram content.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after loading SVG assets.

Detection Strategies

Inspect application logs for POST requests to myems-api/core/svg.py and diff new_values['data'] against a baseline of known-good SVG structures.
Deploy web application firewall rules that flag SVG payloads containing script tags or JavaScript URI schemes submitted to the admin API.
Perform database audits on SVG storage tables to identify entries with executable script content.

Monitoring Recommendations

Alert on administrator sessions that trigger anomalous DOM-initiated API calls immediately after loading SVG content.
Log and review all privileged POST activity to myems-api endpoints, prioritizing entries submitted outside business hours.
Correlate admin authentication events with subsequent SVG modification actions to identify potential account misuse.

How to Mitigate CVE-2026-15321

Immediate Actions Required

Upgrade MyEMS to version 6.5.0 or later, which contains the fix committed as 4a97edfbd786c779d0322054833b21ddf54d5b06.
Audit stored SVG records for injected script content and remove or sanitize any suspicious entries.
Rotate administrative session tokens after patching to invalidate any sessions that may have been targeted.

Patch Information

Upgrade to MyEMS 6.5.0. The fix is available in the MyEMS 6.5.0 release and the upstream repository. See GitHub issue #412 for the vendor discussion. The issue report remains open despite the availability of an official fix.

Workarounds

Restrict access to the MyEMS Admin Backend to trusted network segments using firewall rules or reverse-proxy allowlists.
Enforce a strict Content Security Policy (CSP) on the admin interface to block inline scripts and untrusted script sources.
Limit administrative account issuance and enforce multi-factor authentication to reduce the pool of users capable of triggering the vulnerability.

bash

# Configuration example - upgrade MyEMS to the patched release
git fetch --tags
git checkout v6.5.0
# Verify the patch commit is present
git log --oneline | grep 4a97edf