CVE-2026-71483: Horilla HR Software XSS Vulnerability

CVE-2026-71483 Overview

CVE-2026-71483 is a reflected Cross-Site Scripting (XSS) vulnerability in Horilla, an open-source Human Resources (HR) and Customer Relationship Management (CRM) application. The flaw affects all versions prior to 1.6.0. The search parameter at /employee/employee-filter-view is rendered through jQuery's .html() method inside employee/templates/employee_nav.html without HTML sanitization. An attacker can craft a malicious link that executes arbitrary JavaScript in the browser of any authenticated employee or administrator who visits the employee filter view. The classification maps to [CWE-79: Improper Neutralization of Input During Web Page Generation].

Critical Impact
Successful exploitation enables attackers to access session data and perform authenticated actions with the victim's privileges, including administrator-level HR operations.

Affected Products

Horilla HR and CRM software, all versions prior to 1.6.0
Component: employee/templates/employee_nav.html
Endpoint: /employee/employee-filter-view

Discovery Timeline

2026-09-25 - CVE-2026-71483 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-71483

Vulnerability Analysis

The vulnerability resides in the employee search widget of the Horilla application. When an authenticated user navigates to the employee filter view, client-side JavaScript reads the current value of the search input and injects it directly into the DOM. The injection uses jQuery's .html() method, which parses and executes any HTML or <script> content supplied in the value. Because the search parameter is reflected from the URL into the input field, an attacker can control the payload remotely. User interaction is required: the victim must click an attacker-supplied link while logged in. Once triggered, the payload executes with the privileges of the current session, including administrator-level actions when an admin is targeted.

Root Cause

The root cause is the use of jQuery .html() to render attacker-controllable content without encoding. The vulnerable line reads $('.search_text').html(this.value) where this.value originates from the reflected search URL parameter. jQuery .html() interprets markup, so any <img onerror=...> or similar payload supplied through the search field is parsed and executed. There is no server-side or client-side HTML neutralization applied to the input before DOM insertion.

Attack Vector

Exploitation requires network access to the Horilla instance and user interaction. An attacker crafts a URL containing a malicious payload in the search parameter and delivers it through phishing, chat, or an embedded link. When an authenticated employee or administrator loads the URL, the payload executes in their browser context. The attacker can then exfiltrate session cookies, perform CSRF-style actions, or modify HR records using the victim's authenticated session.

text

                     <ion-icon name="search-outline" class="oh-input-group__icon oh-input-group__icon--left"></ion-icon>
                     <input type="text" placeholder="{% trans 'Search' %}" name="search" id="employee-search"
                         class="oh-input oh-input__icon" aria-label="Search Input" onkeyup="$('.filterButton')[0].click();if(this.value) {
-                            $('.search_text').html(this.value)
+                            $('.search_text').text(this.value)
                             $(this).parent().find('#dropdown').show()
                         }else{
                             $(this).parent().find('#dropdown').hide()

Source: GitHub Commit 39ed013. The patch replaces .html() with .text(), which treats input as literal text and prevents script parsing.

Detection Methods for CVE-2026-71483

Indicators of Compromise

HTTP requests to /employee/employee-filter-view containing <script>, onerror=, onload=, or encoded JavaScript payloads in the search query parameter.
Web server access logs showing unusual URL lengths or percent-encoded HTML entities on the employee filter endpoint.
Outbound browser requests from authenticated HR sessions to unfamiliar domains shortly after visiting the filter page.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that match reflected XSS signatures on the search parameter of /employee/employee-filter-view.
Enable Content Security Policy (CSP) reporting to capture inline-script violations originating from the employee filter view.
Review browser referrer and request telemetry for employees who received external links referencing the Horilla instance.

Monitoring Recommendations

Alert on successful administrator-initiated HR record changes that follow a navigation to /employee/employee-filter-view with a non-empty search parameter.
Monitor session cookie use from new IP addresses or user agents within short time windows of filter-view access.
Correlate email gateway and chat logs for links targeting the Horilla hostname with suspicious query strings.

How to Mitigate CVE-2026-71483

Immediate Actions Required

Upgrade Horilla to version 1.6.0 or later, which replaces the vulnerable .html() call with .text().
Instruct employees and administrators to avoid clicking untrusted links referencing the Horilla application until the patch is applied.
Rotate active session tokens after upgrading to invalidate any sessions that may have been exposed.

Patch Information

The fix is published in Horilla version 1.6.0. The code change is documented in GitHub Commit 39ed013 and GitHub Security Advisory GHSA-rw86-x8hq-xgwh. Operators running source deployments should pull the updated employee/templates/employee_nav.html and redeploy static assets.

Workarounds

Place the Horilla instance behind a WAF with a rule blocking HTML metacharacters in the search parameter of /employee/employee-filter-view.
Enforce a strict Content Security Policy that disallows inline script execution across Horilla pages.
Restrict access to the Horilla application through VPN or SSO to reduce exposure to externally delivered links.

bash

# Example upgrade workflow for a Horilla source deployment
git fetch --tags
git checkout v1.6.0
pip install -r requirements.txt
python manage.py collectstatic --noinput
python manage.py migrate
systemctl restart horilla