CVE-2026-68900: Wekan: Stored XSS in HTML board exports through a card-title second parse
Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A board member could store an entity-encoded event-handler payload in a card title that remained inert on the live board but was reparsed and executed when a recipient clicked the card in the downloaded HTML export, allowing the script to read and transmit all board data contained in that export, including content added after the attacker's membership was removed. Version 10.23 builds the modal with DOM nodes and assigns untrusted values through textContent. This issue is fixed in version 10.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wekanto a version that resolves this vulnerability.Fixed in 10.23
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk?
A board member can place an entity-encoded event-handler payload in a card title. Risk materializes when another user opens the downloaded HTML export and clicks the affected card.
What information can malicious code access if triggered?
The script can read and transmit all board data contained in the HTML export. This can include content added after the attacker’s board membership was removed.
Which installations and exports should be treated as affected?
Wekan versions from 8.72 through versions before 10.23 are affected. HTML board exports generated by those versions may contain the vulnerable rendering behavior when they include a malicious card title.
What should be done if an upgrade cannot be applied immediately?
Avoid opening or distributing HTML board exports that may include content created by untrusted or former board members, especially where recipients may click cards. Upgrade to version 10.23, which creates the export modal with DOM nodes and assigns untrusted values using textContent.