CVE-2026-40479: Kimai Time Tracking XSS Vulnerability

CVE-2026-40479 Overview

CVE-2026-40479 is a stored Cross-Site Scripting (XSS) vulnerability in Kimai, an open-source time tracking application. The vulnerability exists in the escapeForHtml() function within KimaiEscape.js, which fails to properly escape double quote and single quote characters. When a user's profile alias is inserted into an HTML attribute context via the team member form prototype and rendered through innerHTML, this incomplete escaping allows HTML attribute injection, enabling authenticated attackers to execute arbitrary JavaScript in the browsers of other users, including administrators.

Critical Impact

An authenticated user with basic ROLE_USER privileges can store a malicious alias that executes JavaScript in the browser of any administrator viewing the team form, resulting in stored XSS with privilege escalation potential.

Affected Products

• Kimai versions 1.16.3 through 2.52.0
• Self-hosted Kimai installations
• Kimai Docker deployments running vulnerable versions

Discovery Timeline

• 2026-04-17 - CVE CVE-2026-40479 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-40479

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The root issue lies in the incomplete implementation of the escapeForHtml() function in KimaiEscape.js, which is designed to sanitize user input before rendering it in the browser.

The function fails to escape single quotes (') and double quotes ("), which are critical characters when user-controlled data is placed within HTML attribute contexts. When a user's profile alias is processed through the team member form prototype and subsequently rendered using innerHTML, the unescaped quote characters allow an attacker to break out of the attribute context and inject arbitrary HTML or JavaScript code.

The attack requires low privileges (ROLE_USER) and user interaction (an administrator must view the team form), but the scope is changed as the vulnerability affects users beyond the authenticated session of the attacker. The stored nature of this XSS means the malicious payload persists and executes each time the affected page is viewed.

Root Cause

The escapeForHtml() function in KimaiEscape.js implements incomplete character escaping. While it may handle characters like < and >, it neglects to escape quotation marks. In HTML attribute contexts, double and single quotes serve as attribute delimiters. By injecting these characters, an attacker can terminate the current attribute and introduce new attributes, including event handlers like onmouseover, onfocus, or onerror that execute JavaScript.

The vulnerable code path occurs when user-supplied alias data flows from the profile settings through the team member form prototype, ultimately being rendered via innerHTML without adequate sanitization.

Attack Vector

The attack is network-based and requires the attacker to have authenticated access with at least ROLE_USER privileges. The exploitation flow involves:

1. An authenticated user modifies their profile alias to include a malicious payload containing quote characters and JavaScript event handlers
2. The malicious alias is stored in the application database
3. When an administrator navigates to the team management form, the application retrieves team member data including the attacker's alias
4. The alias is processed through the vulnerable escapeForHtml() function, which fails to escape the quote characters
5. The insufficiently sanitized data is rendered via innerHTML within an HTML attribute context
6. The attacker's payload breaks out of the attribute and executes JavaScript in the administrator's browser session

This stored XSS can be leveraged for session hijacking, privilege escalation, data exfiltration, or performing actions on behalf of the administrator.

Detection Methods for CVE-2026-40479

Indicators of Compromise

• Unusual or suspicious characters in user profile alias fields, particularly quote characters followed by event handlers (e.g., " onmouseover=, ' onclick=)
• JavaScript keywords appearing in user profile data (e.g., alert, document.cookie, eval, XMLHttpRequest)
• Unexpected administrative actions or user privilege changes that correlate with team form access
• Browser console errors or unexpected script execution warnings when viewing team management pages

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Deploy Web Application Firewall (WAF) rules to identify XSS payloads in form submissions and profile updates
• Monitor application logs for profile updates containing HTML special characters or JavaScript syntax
• Use browser-based XSS auditors and security extensions during administrative sessions
• Conduct regular code reviews focusing on user input handling and output encoding functions

Monitoring Recommendations

• Enable detailed logging for all user profile modifications, capturing the full content of updated fields
• Configure alerting for profile aliases exceeding typical length or containing special character patterns
• Monitor for CSP violation reports which may indicate XSS exploitation attempts
• Track administrative session anomalies following access to team management interfaces
• Implement real-time monitoring of JavaScript execution contexts in sensitive application areas

How to Mitigate CVE-2026-40479

Immediate Actions Required

• Upgrade Kimai to version 2.53.0 or later immediately
• Audit existing user profile aliases for malicious content before and after upgrading
• Review application access logs for any signs of exploitation prior to patching
• Temporarily restrict access to team management features if immediate patching is not possible
• Notify administrators to be cautious when accessing team forms until the patch is applied

Patch Information

The Kimai development team has addressed this vulnerability in version 2.53.0. The fix properly implements character escaping in the escapeForHtml() function to include double and single quote characters, preventing HTML attribute injection. Organizations should upgrade to this version or later to remediate the vulnerability.

For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-g82g-m9vx-vhjg and the GitHub Release v2.53.0.

Workarounds

• Implement server-side input validation to reject profile aliases containing quote characters or HTML special characters
• Deploy a Web Application Firewall with rules to block XSS payloads in form submissions
• Apply Content Security Policy headers with strict script-src directives to mitigate script injection impact
• Restrict ROLE_USER privileges where possible to limit the attack surface
• Consider using a reverse proxy to sanitize user input before it reaches the application

# Example: Add Content Security Policy headers via Apache configuration
# Add to .htaccess or Apache virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"

# Example: Nginx CSP header configuration
# Add to server block in nginx.conf
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';" always;