CVE-2026-96535: Cross-Site Scripting in the YouMind web application
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN’s domain.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Sanitise and validate SVG content before accepting it as a profile picture, rejecting SVG images that contain embedded JavaScript.
YouMind avatar update endpoint SVG content sanitisation and validation = enabled - Configuration
Serve user-uploaded SVG avatar files in a way that prevents embedded scripts from executing in the CDN domain.
YouMind CDN Content-Type for user-uploaded SVG avatars = non-executable image content
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a YouMind account or other access that allows updating a profile avatar, because the vulnerable path is the avatar update endpoint. They can provide an SVG hosted at an arbitrary URL that contains embedded JavaScript.
Does exploitation require a victim to take action?
Yes. The victim must navigate directly to the CDN URL serving the malicious SVG. The embedded script then executes in the context of the CDN domain.
What is the impact on the YouMind application itself?
The supplied information states that the script executes in the CDN domain’s context, not necessarily the YouMind portal’s origin. The CVSS vector indicates low-impact confidentiality and integrity effects, with no availability impact.
How can I check whether my deployment is exposed?
Check whether users can set avatars from arbitrary URLs and whether SVG files are accepted without sanitizing or validating embedded content. Also verify whether uploaded or referenced SVG avatars are served by the CDN as image/svg+xml.