CVE-2026-41250: Taiga Project Management XSS Vulnerability

CVE-2026-41250 Overview

CVE-2026-41250 is a stored Cross-Site Scripting (XSS) vulnerability affecting Taiga, an open-source project management platform used by startups and agile development teams. The flaw resides in the taiga-front component prior to version 6.9.1. Attackers with low-privilege authenticated access can inject malicious HTML or JavaScript into confirmation dialog messages, which are rendered as HTML in the victim's browser. Exploitation requires user interaction, but successful attacks can lead to session theft, credential harvesting, and unauthorized actions executed in the victim's context. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in other users' browser sessions, potentially compromising project data confidentiality across collaborative Taiga workspaces.

Affected Products

• Taiga taiga-front versions prior to 6.9.1
• Taiga project management platform self-hosted deployments
• Taiga collaborative agile development workspaces

Discovery Timeline

• 2026-05-11 - CVE-2026-41250 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-41250

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Taiga front-end ConfirmService component. The service rendered user-controlled message content through the .html() jQuery method after passing it through a textToHTML filter. Because the message body was injected as HTML rather than text, an attacker who could persist crafted input into fields displayed by confirmation dialogs could deliver active script payloads to other users.

The issue affects all installations of taiga-front before 6.9.1. Exploitation requires an authenticated user with the ability to write content into shared project fields, and a victim who triggers the confirmation dialog rendering the malicious payload.

Root Cause

The root cause is unsafe HTML rendering in app/coffee/modules/common/confirm.coffee. The original code path applied a textToHTML filter and then assigned the result via .html(), which executes embedded markup. The fix replaces this with a .text() assignment, ensuring the message is treated as inert string content rather than parsed as HTML.

Attack Vector

An authenticated attacker injects a crafted payload into a project field whose value is later displayed in a confirmation dialog. When another user, such as a project administrator, triggers an action that opens the dialog, the payload executes in that user's browser session under the Taiga origin. This allows the attacker to perform actions as the victim or exfiltrate session data.

         # Render content
         el.find(".title").text(title || '')
         el.find(".subtitle").text(subtitle || '')
-        if message
-            message = @filter('textToHTML')(message)
-        el.find(".message").html(message || '')
+        el.find(".message").text(message || '')
 
         # Assign event handlers
         el.on "click.confirm-dialog", ".js-confirm", debounce 2000, (event) =>

Source: taiga-front commit a9ab31a2. This patch removes the textToHTML filter call and replaces .html() with .text(), neutralizing HTML and script content in confirmation messages.

Detection Methods for CVE-2026-41250

Indicators of Compromise

• Unexpected <script>, <img onerror=...>, or event-handler attributes stored in Taiga project fields such as titles, descriptions, or tag names.
• Outbound browser requests from authenticated Taiga sessions to attacker-controlled domains shortly after a user interacts with a confirmation dialog.
• Unauthorized API calls to Taiga endpoints originating from legitimate user sessions without corresponding user-initiated UI activity.

Detection Strategies

• Inspect the taiga-front deployed version and verify it is at or above 6.9.1 across all environments.
• Review database fields rendered through ConfirmService for HTML markup or JavaScript payload patterns using regex queries on stored project content.
• Monitor browser Content Security Policy (CSP) violation reports for inline script execution attempts on Taiga origins.

Monitoring Recommendations

• Enable web server access logging for /api/v1/ Taiga endpoints and correlate write operations with subsequent suspicious read activity.
• Forward Taiga application logs and front-end CSP reports to a centralized analytics platform for query and alerting on XSS indicators.
• Track authenticated session anomalies, including impossible-travel logins and elevated permission changes following dialog interactions.

How to Mitigate CVE-2026-41250

Immediate Actions Required

• Upgrade taiga-front to version 6.9.1 or later on all Taiga instances without delay.
• Audit existing project content for stored HTML or script payloads and sanitize affected records.
• Rotate session tokens and force re-authentication for users who may have interacted with malicious confirmation dialogs.

Patch Information

The vulnerability is fixed in taiga-front 6.9.1. The remediation commit replaces unsafe HTML rendering in confirm.coffee with text-only assignment. Review the GitHub Security Advisory GHSA-fpm6-3pvx-3c46 and the Neodyme CVE Advisory for full disclosure details.

Workarounds

• Restrict project membership and write permissions to trusted users until the patch is applied.
• Deploy a strict Content Security Policy that disallows inline scripts and limits script sources on the Taiga origin.
• Place Taiga behind a Web Application Firewall (WAF) configured to inspect and block common XSS payload patterns in API write requests.

# Example Nginx CSP header to reduce XSS impact pending upgrade
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;