CVE-2026-54049: Sakai Conversations Tool XSS Vulnerability

CVE-2026-54049 Overview

CVE-2026-54049 is a stored cross-site scripting (XSS) vulnerability in the Sakai Collaboration and Learning Environment (CLE). The flaw resides in the Sakai Conversations tool, which stores topic and post messages without HTML sanitization. The frontend then renders this content using LitElement's unsafeHTML() directive, allowing arbitrary HTML and JavaScript execution. Any authenticated user with access to a site that has the Conversations tool enabled can inject malicious payloads. These payloads execute in the browsers of all users who view the compromised topic or post. The vulnerability affects Sakai versions 23.0 to before 23.5 and versions 25.0 to before 25.3. It is tracked under CWE-79.

Critical Impact
Authenticated attackers can inject persistent JavaScript into Conversations topics and posts, hijacking sessions and compromising every user who loads the affected page.

Affected Products

Sakai CLE versions 23.0 through 23.4
Sakai CLE versions 25.0 through 25.2
Sakai Conversations tool (all deployments with the tool enabled)

Discovery Timeline

2026-10-01 - CVE-2026-54049 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-54049

Vulnerability Analysis

The vulnerability exists in the Sakai Conversations tool's handling of user-submitted content. Topic and post messages are persisted to the database without server-side HTML sanitization. When the frontend retrieves these messages, it uses LitElement's unsafeHTML() directive to render them. This directive explicitly bypasses the framework's default HTML escaping protections. As a result, any HTML or JavaScript included in a stored message executes in the browser context of every user who views the content.

The payload runs with the full privileges of the viewing user's session. Attackers can steal session cookies, perform actions on behalf of the victim, exfiltrate course data, or pivot to administrative accounts if an instructor or administrator loads the page.

Root Cause

The root cause is the absence of HTML sanitization in the Conversations service layer combined with unsafe rendering on the client. The patch introduces the FormattedText utility (org.sakaiproject.util.api.FormattedText) into ConversationsServiceImpl. This Sakai utility strips or neutralizes dangerous markup before messages are stored or returned to the frontend.

Attack Vector

Exploitation requires an authenticated account with write access to a site where the Conversations tool is enabled. The attacker creates a new topic or post containing a crafted HTML payload with embedded script content. Once persisted, the payload triggers automatically for any user who navigates to the affected topic. No additional interaction beyond viewing the content is needed.

java

// Patch: injecting FormattedText dependency into ConversationsServiceImpl
 import org.sakaiproject.user.api.UserNotDefinedException;
 import org.sakaiproject.util.CalendarEventType;
 import org.sakaiproject.util.ResourceLoader;
+import org.sakaiproject.util.api.FormattedText;
 import org.sakaiproject.entity.api.EntityTransferrer;

 import com.fasterxml.jackson.core.JsonProcessingException;

Source: GitHub Sakai Commit 2696b4b

xml

<!-- Patch: wiring FormattedText bean into Conversations components -->
     <property name="eventTrackingService" ref="org.sakaiproject.event.api.EventTrackingService" />
+    <property name="formattedText" ref="org.sakaiproject.util.api.FormattedText" />
     <property name="functionManager" ref="org.sakaiproject.authz.api.FunctionManager" />

Source: GitHub Sakai Commit 2696b4b

Detection Methods for CVE-2026-54049

Indicators of Compromise

Conversations topics or posts containing <script>, <img onerror=>, <svg onload=>, or javascript: URI patterns
Outbound HTTP requests from user browsers to unknown domains correlated with viewing Conversations pages
Unexpected session token activity following access to specific Conversations topics
Database rows in the Conversations tables containing unencoded HTML tags in message fields

Detection Strategies

Query the Conversations message store for persisted payloads containing event handler attributes or script tags
Deploy Content Security Policy (CSP) reporting to capture inline script violations on Conversations pages
Review web server access logs for unusual POST payloads targeting Conversations REST endpoints
Correlate user complaints of unexpected redirects or logouts with Conversations activity windows

Monitoring Recommendations

Enable application-level audit logging for all Conversations create and update operations
Monitor browser-side CSP violation reports and forward them to the SIEM for triage
Track administrative account activity following any Conversations page view by privileged users
Alert on bulk edits or new topics from accounts without prior Conversations history

How to Mitigate CVE-2026-54049

Immediate Actions Required

Upgrade Sakai to version 23.5, 25.3, or 26.0 as soon as possible
Audit existing Conversations topics and posts for stored HTML payloads and purge malicious content
Rotate session tokens and force re-authentication for users who accessed affected sites
Temporarily disable the Conversations tool on exposed sites until the upgrade is applied

Patch Information

The Sakai project has released fixes in versions 23.5, 25.3, and 26.0. The remediation introduces the FormattedText service dependency in ConversationsServiceImpl and wires it through components.xml. Content is sanitized before persistence, eliminating the stored payload path. Full technical details are available in the GitHub Security Advisory GHSA-w2x5-gv52-9ccv and the patch commit.

Workarounds

Disable the Conversations tool across all sites until patching is complete
Restrict Conversations write permissions to a minimal set of trusted roles
Deploy a strict Content Security Policy that blocks inline script execution on Sakai pages
Place a web application firewall (WAF) rule in front of Conversations endpoints to filter HTML tags in message payloads

bash

# Example: upgrade a Sakai 25.x deployment to the patched release
cd /opt/sakai
git fetch --tags
git checkout 25.3
mvn clean install -DskipTests
# Restart Tomcat to load the patched Conversations module
systemctl restart tomcat