CVE-2026-1008: Stored Cross-Site Scripting in Altium Live User Profile Fields
A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques. The injected payload is persisted and executed when other users view the affected profile page, potentially allowing session token theft, phishing attacks, or malicious redirects. Exploitation requires an authenticated account and user interaction to view the crafted profile.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1008?
CVE-2026-1008 has been rated as a medium severity vulnerability due to its potential for exploitation via stored cross-site scripting.
How do I fix CVE-2026-1008?
To fix CVE-2026-1008, ensure that server-side input sanitization is properly implemented for all user profile text fields.
Who is affected by CVE-2026-1008?
CVE-2026-1008 affects users of Altium 365, specifically those who can modify user profile text fields.
What type of vulnerability is CVE-2026-1008?
CVE-2026-1008 is classified as a stored cross-site scripting (XSS) vulnerability.
What can attackers do with CVE-2026-1008?
Attackers can exploit CVE-2026-1008 to inject arbitrary HTML and JavaScript payloads into user profile fields, potentially leading to session hijacking or data theft.