CVE-2026-38569: HireFlow v1.2 XSS Vulnerability

CVE-2026-38569 Overview

CVE-2026-38569 is a stored Cross-Site Scripting (XSS) vulnerability in HireFlow v1.2, an open-source interview management system. The flaw resides in candidate_detail.html and is triggered through the Resume or Feedback Comment fields submitted via POST /candidates/add or POST /feedback/add. Authenticated attackers can inject malicious JavaScript that executes in the browser of any user who views the affected candidate detail page. The issue is classified under [CWE-79] for improper neutralization of input during web page generation.

Critical Impact
Authenticated low-privilege users can persist arbitrary JavaScript in candidate records, enabling session theft, credential phishing, and actions performed in the context of higher-privileged reviewers.

Affected Products

HireFlow v1.2 (Straton Web Designers)
HireFlow distributions published via SourceCodester
Any deployment of the upstream HireFlow GitHub repository at or before v1.2

Discovery Timeline

2026-05-11 - CVE-2026-38569 published to the National Vulnerability Database (NVD)
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-38569

Vulnerability Analysis

HireFlow accepts free-form text in the Resume and Feedback Comment fields when recruiters or interviewers submit data through POST /candidates/add and POST /feedback/add. The application stores the submitted content and later renders it inside candidate_detail.html without contextual output encoding. As a result, HTML and script payloads embedded in those fields are interpreted by the browser when any authenticated user opens the candidate profile.

The vulnerability is stored (persistent) rather than reflected, so each visit to the affected record re-executes the payload. Exploitation requires a low-privilege authenticated account and a victim interaction (viewing the candidate page), and the scope is changed because injected script executes in the trusted application origin against other users' sessions.

Root Cause

The root cause is missing server-side input sanitization combined with absent output encoding in the Jinja-style template that produces candidate_detail.html. User-controlled strings from the resume and comment form parameters are rendered as raw HTML rather than escaped text, allowing tags such as <script> and event handlers like onerror to reach the DOM.

Attack Vector

An attacker with a valid HireFlow account submits a crafted candidate or feedback record containing JavaScript in the Resume or Feedback Comment field. The payload is stored in the application database. When a recruiter, hiring manager, or administrator browses the candidate detail page, the payload executes in their session and can exfiltrate cookies, perform CSRF-like actions, or rewrite the page to harvest credentials.

The vulnerability manifests at the boundary between form intake handlers (/candidates/add, /feedback/add) and the template rendering routine for candidate_detail.html. See the GitHub CVE-2026-38569 Disclosures for the disclosing researcher's technical notes and the HireFlow source repository for the affected code paths.

Detection Methods for CVE-2026-38569

Indicators of Compromise

Candidate or feedback records containing <script>, <img onerror=, javascript:, or other HTML/JS constructs in the Resume or Feedback Comment fields
Unexpected outbound requests from reviewer browsers to attacker-controlled domains shortly after opening candidate_detail.html
Session cookies or CSRF tokens appearing in web server access logs as query string parameters on external hosts

Detection Strategies

Query the HireFlow database for candidate and feedback rows where the resume or comment columns contain angle brackets, on*= event attributes, or javascript: URIs
Inspect HTTP request bodies to POST /candidates/add and POST /feedback/add in web server or WAF logs for HTML markup in fields that should be plain text
Enable Content Security Policy (CSP) reporting and monitor report-uri endpoints for blocked inline script executions on /candidates/* paths

Monitoring Recommendations

Alert on anomalous JavaScript-bearing payloads submitted by low-privilege HireFlow accounts
Correlate views of recently modified candidate records with outbound DNS or HTTP requests from reviewer endpoints
Track authentication anomalies (session reuse from new IPs) for accounts that recently viewed a candidate page authored by an untrusted user

How to Mitigate CVE-2026-38569

Immediate Actions Required

Restrict access to HireFlow /candidates/add and /feedback/add endpoints to trusted users until a patched build is deployed
Audit existing candidate and feedback records and remove or sanitize any entries containing HTML or script content
Deploy a strict Content Security Policy that disallows inline scripts to blunt exploitation of stored payloads

Patch Information

No official vendor patch has been published in the NVD references at the time of writing. Operators should monitor the upstream HireFlow repository for fixes and review the SourceCodester HireFlow project page for updated downloads. Until a vendor fix is released, apply the workarounds below and recompile from source with output encoding enabled in the affected templates.

Workarounds

Apply server-side sanitization to the resume and comment parameters using a library such as bleach with an allowlist of safe tags, or strip HTML entirely
Modify candidate_detail.html to render user fields using auto-escaping (for example, ensure Jinja autoescape is enabled and avoid the |safe filter on user-controlled variables)
Place HireFlow behind a Web Application Firewall (WAF) rule that blocks request bodies containing <script, onerror=, or javascript: on the vulnerable endpoints

bash

# Configuration example: minimal nginx WAF-style block for the affected endpoints
location ~ ^/(candidates|feedback)/add$ {
    if ($request_method = POST) {
        set $block 0;
        if ($request_body ~* "<script|onerror=|onload=|javascript:") { set $block 1; }
        if ($block = 1) { return 403; }
    }
    proxy_pass http://hireflow_upstream;
}