CVE-2026-55876: Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKEDATTACHMENTEXTENSIONS and BLOCKEDATTACHMENTMIMETYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Heliumto a version that resolves this vulnerability.Fixed in 2.2.60
Event History
Frequently Asked Questions
Who can exploit this issue, and what interaction is required?
An authenticated Helium user can upload an SVG or HTML attachment containing active content. A victim must then open the uploaded attachment's public URL for embedded SVG script to execute.
Are default deployments affected by application-session theft?
The maintained deployment configuration serves attachments from a separate origin. As a result, same-origin policy prevents attachment-hosted script from reading application cookies or storage, and application-session compromise is not supported by that configuration.
Which versions need remediation?
Helium versions prior to 2.2.60 are affected. Upgrade to version 2.2.60, which blocks the unsafe attachment formats.
What is the practical impact if an unsafe attachment has already been uploaded?
The attachment can deliver persistent attacker-controlled active content and phishing from an application-managed storage URL when its public URL is opened. Review existing SVG and HTML attachments and remove or restrict access to untrusted files.