CVE-2026-33402: Sakai CLE XSS Vulnerability

CVE-2026-33402 Overview

CVE-2026-33402 is a Cross-Site Scripting (XSS) vulnerability affecting Sakai, an open-source Collaboration and Learning Environment (CLE) widely used in educational institutions. The vulnerability exists in versions 23.0 through 23.4 and 25.0 through 25.1, where group titles and descriptions can contain cross-site scripting scripts due to insufficient input sanitization.

Critical Impact

Attackers can inject malicious scripts into group titles and descriptions, potentially compromising user sessions, stealing sensitive information, or performing unauthorized actions on behalf of authenticated users within the learning management system.

Affected Products

• Sakai versions 23.0 through 23.4
• Sakai versions 25.0 through 25.1
• Sakai installations with user-modifiable group titles and descriptions

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-33402 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33402

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in how Sakai handles user-supplied input in group titles and descriptions. When users create or modify groups within the learning environment, the application fails to properly sanitize or encode the input before rendering it in web pages.

The vulnerability requires network access to exploit and user interaction, as a victim must view a page containing the malicious group title or description. While the immediate impact is contained to the user's session context, successful exploitation could lead to session hijacking, credential theft, or defacement of the learning environment interface.

Root Cause

The root cause lies in the absence of proper input validation and output encoding mechanisms for the group title and description fields. User-supplied content is stored directly in the SAKAI_SITE_GROUP database table without adequate sanitization. When this content is subsequently rendered in the user interface, the malicious scripts execute in the context of the victim's browser session.

Attack Vector

The attack vector is network-based and requires an attacker to have the ability to create or modify group information within a Sakai instance. The attacker injects malicious JavaScript code into either the title or description field of a group. When other users—particularly administrators or instructors—view pages that display this group information, the malicious script executes in their browser.

This stored XSS attack persists in the database, affecting all users who subsequently view the compromised content. The attack does not require any special privileges beyond the ability to modify group metadata, making it accessible to standard authenticated users in many Sakai deployments.

Detection Methods for CVE-2026-33402

Indicators of Compromise

• Unexpected JavaScript code or HTML tags present in the SAKAI_SITE_GROUP table's title and description columns
• Users reporting unusual behavior or pop-ups when viewing group pages
• Browser security console logging XSS-related warnings originating from Sakai pages
• Anomalous session activity following group page visits

Detection Strategies

• Query the SAKAI_SITE_GROUP database table for entries containing <script>, javascript:, onerror=, onload=, or other common XSS payload patterns
• Implement Web Application Firewall (WAF) rules to detect and block XSS injection attempts in group creation/modification requests
• Deploy Content Security Policy (CSP) headers to prevent inline script execution and report violations
• Enable browser-based XSS auditor logs and monitor for triggered events

Monitoring Recommendations

• Monitor database audit logs for suspicious modifications to group titles and descriptions
• Configure alerting for any Content Security Policy violations reported by user browsers
• Review access logs for unusual patterns of group creation or modification activity
• Implement file integrity monitoring on Sakai application files to detect any unauthorized modifications

How to Mitigate CVE-2026-33402

Immediate Actions Required

• Upgrade Sakai installations to version 25.2 or 23.5 which contain the security patch
• Audit the SAKAI_SITE_GROUP table immediately for any existing malicious content in title and description fields
• Consider temporarily restricting group creation and modification permissions until patching is complete
• Implement Content Security Policy headers as an additional defense layer

Patch Information

The vulnerability has been addressed in Sakai releases 25.2 and 23.5. Organizations should prioritize upgrading to these patched versions. Additional details about the fix are available in the GitHub Security Advisory and the Sakai Project Issue Tracker.

Workarounds

• Manually inspect and sanitize the SAKAI_SITE_GROUP table by querying for titles and descriptions containing potential XSS payloads such as <script> tags or event handlers
• Restrict group creation and modification permissions to trusted administrators only until patches can be applied
• Implement database-level triggers to reject input containing suspicious patterns in group metadata fields
• Deploy a Web Application Firewall with XSS detection rules in front of the Sakai application

-- Database inspection query for potential XSS content
SELECT * FROM SAKAI_SITE_GROUP 
WHERE TITLE LIKE '%<script%' 
   OR TITLE LIKE '%javascript:%' 
   OR DESCRIPTION LIKE '%<script%' 
   OR DESCRIPTION LIKE '%javascript:%'
   OR TITLE LIKE '%onerror=%'
   OR DESCRIPTION LIKE '%onerror=%';