CVE-2026-63157: Omnispace Agora Project < 26.10.0 Stored XSS via Links Module
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address (adress) field that is echoed into an onclick event-handler attribute without neutralizing quotes. Attackers can store a crafted payload through the Links module that executes in the browser of any user viewing the links list, enabling session hijacking or further client-side compromise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Omnispace Agora Projectto a version that resolves this vulnerability.Fixed in 26.10.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability, and who is at risk from a stored payload?
An authenticated user who can submit a link through the Links module can store the malicious value. Any user who later views the links list may have the script execute in their browser.
What input is involved in exploitation?
The vulnerable input is the link address (adress) field in the Links module. Crafted quote characters can escape the onclick event-handler attribute because the value is not properly neutralized.
Is user interaction required for impact?
Yes. The stored payload executes when a user views the links list containing the malicious entry. The attacker must also be authenticated to submit the crafted link.
What version addresses the issue?
The issue affects versions before 26.10.0. Updating to version 26.10.0 or later addresses the affected version range described here.