CVE-2026-63171: Omnispace Agora Project < 26.10.0 Stored XSS via Category Description
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute. Attackers can exploit the HTMLPurifier configuration that preserves double-quotes to escape the attribute context and execute arbitrary script in the browser of users viewing the forum category.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Omnispace Agora Projectto a version that resolves this vulnerability.Fixed in 26.10.0
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from it?
An attacker must be authenticated and able to submit a crafted forum category description. Users who view the affected forum category may have attacker-controlled script execute in their browsers.
What does an attacker need to include in the category description?
The exploit relies on a double-quote character in the submitted description to break out of an HTML input value attribute. The preserved double-quote handling in the HTMLPurifier configuration enables escape from that attribute context.
Which versions should be remediated?
Omnispace Agora Project versions before 26.10.0 are affected. Upgrade to version 26.10.0 or later.