CVE-2026-24665: Open eClass Platform XSS Vulnerability

CVE-2026-24665 Overview

A stored Cross-Site Scripting (XSS) vulnerability has been identified in the Open eClass platform (formerly known as GUnet eClass), a complete course management system used by educational institutions. Prior to version 4.2, this vulnerability allows authenticated students to inject malicious JavaScript code into uploaded assignment files. The injected script executes when instructors view the submitted assignment, potentially compromising instructor accounts and sensitive educational data.

Critical Impact

Authenticated students can execute arbitrary JavaScript in the context of instructor sessions, potentially leading to session hijacking, credential theft, or unauthorized access to grading systems and student data.

Affected Products

• Open eClass (GUnet eClass) versions prior to 4.2

Discovery Timeline

• 2026-02-03 - CVE CVE-2026-24665 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-24665

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) exists in the assignment submission functionality of the Open eClass platform. The vulnerability arises from insufficient input sanitization and output encoding when processing uploaded assignment files. When a student submits an assignment containing malicious JavaScript, the payload is stored in the system and later rendered without proper sanitization when an instructor accesses the submission for review.

The attack requires authenticated access as a student, and user interaction from an instructor who must view the malicious submission. However, the impact is significant as the malicious script executes within the instructor's browser context, which typically has elevated privileges within the learning management system. This can lead to session compromise, unauthorized grade modifications, or access to other students' personal information.

Root Cause

The root cause is improper neutralization of input during web page generation. The assignment upload and viewing functionality fails to adequately sanitize user-supplied content before storing it in the database and subsequently rendering it in the instructor's browser. This lack of proper input validation and output encoding allows arbitrary JavaScript to be embedded and executed.

Attack Vector

The attack is network-based and requires authenticated access with low privileges (student-level). An attacker would craft a malicious assignment file containing JavaScript payloads and submit it through the normal assignment submission interface. When an instructor navigates to view the submitted assignment, the stored JavaScript executes automatically in their browser session.

The vulnerability has a changed scope, meaning the impact extends beyond the vulnerable component itself—compromising instructor sessions can affect the broader platform's security posture and other users' data.

Detection Methods for CVE-2026-24665

Indicators of Compromise

• Review web server logs for unusual assignment submissions containing HTML tags or script elements
• Monitor for unexpected JavaScript execution patterns in instructor browser sessions
• Check for anomalous session activity following assignment review operations
• Audit assignment submissions for embedded <script> tags or event handlers such as onerror, onload, or onclick attributes

Detection Strategies

• Implement web application firewall (WAF) rules to detect XSS payloads in assignment upload requests
• Deploy browser-based security tools to detect and block malicious script execution
• Enable Content Security Policy (CSP) headers to restrict inline script execution
• Configure SentinelOne Singularity Platform to monitor for suspicious browser behavior and script injection attempts

Monitoring Recommendations

• Enable detailed logging for all assignment submission and viewing activities
• Set up alerts for file uploads containing potential script content
• Monitor instructor account activity for signs of session hijacking following assignment reviews
• Regularly audit stored assignment content for malicious payloads

How to Mitigate CVE-2026-24665

Immediate Actions Required

• Upgrade Open eClass to version 4.2 or later immediately
• Review recent assignment submissions for potentially malicious content
• Consider temporarily restricting assignment file types until the patch is applied
• Implement Content Security Policy headers as an additional defense layer

Patch Information

This vulnerability has been patched in Open eClass version 4.2. Administrators should upgrade to this version or later to remediate the vulnerability. For detailed patch information and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

• Implement strict Content Security Policy headers to prevent inline script execution
• Configure server-side input validation to strip or encode HTML and JavaScript from assignment submissions
• Use a web application firewall to filter XSS attack patterns in incoming requests
• Instruct instructors to use browser plugins that block JavaScript execution when reviewing untrusted content

# Example: Add Content Security Policy header in Apache configuration
# Add to httpd.conf or .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"