CVE-2026-115993: Stored XSS in the “Notes” field of project checklists

Published Oct 24, 2026

Updated

Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges

Affected Software

1 affected component

Cervantes Cervantes=v1.3-beta

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Cervantes to a version that resolves this vulnerability.
Fixed in 1.4.0-beta

Event History

Oct 24, 2026

CVE Published

via MITRE·08:32 AM

Data Sourced

via MITRE·08:32 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access and user interaction are required to exploit this issue?

An attacker needs low-level privileges to enter malicious content into a checklist Notes field. A separate user must then view the stored content in their browser for the XSS payload to execute.

What is the likely impact if the payload executes?

The vulnerability can execute arbitrary code in the viewing user's browser with elevated privileges. The published vector indicates high confidentiality impact, with no stated integrity or availability impact.

Which deployments are identified as affected?

The reported affected version is Cervantes v1.3-beta. The available information does not state whether other versions or default configurations are affected.