CVE-2026-14752: Authenticated XSS in mjperpinosa stumasy—Exploit Disclosed

Technical summary

This vulnerability combines CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code), indicating insufficient input validation and sanitization in the add_definition function. The attack vector is network-accessible and requires only low complexity to execute, but mandates prior authentication and user interaction (UI:R). The vulnerable parameter is the 'reference' argument in add_into_dictionary.php. Since mjperpinosa stumasy employs continuous rolling releases rather than versioned releases, traditional version tracking is unavailable; the vulnerability affects commits up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be.

Business impact

The low CVSS score (3.5) reflects the requirement for authentication and user interaction, limiting exposure to internal users or low-privilege account holders. However, if this project powers internal knowledge bases or collaborative note-taking systems, an authenticated attacker could execute client-side attacks against other users, potentially stealing session tokens or performing actions on their behalf. The reputational impact of unpatched public exploits should not be underestimated, even for low-severity issues in open-source projects.

Affected systems

mjperpinosa stumasy (rolling release model; affected through commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be). Organizations using this project should verify their deployed commit hash against the disclosed boundary. Because the project uses continuous delivery without traditional versioning, affected deployments must be identified by Git commit rather than semantic version.

Exploitability

Exploitability is moderate. The attack requires an authenticated user and relies on social engineering or user interaction to trigger (such as clicking a malicious link within the application). Public disclosure of the exploit removes the zero-day advantage. However, the need for both authentication and UI interaction reduces the risk of automated or mass exploitation. The remote network vector means any internet-exposed instance is theoretically accessible to authenticated users.

Remediation

Monitor the mjperpinosa stumasy repository for commits that address input sanitization in add_into_dictionary.php and add_definition. Since rolling releases are used, remediation will likely be a commit hash rather than a version bump. Organizations should update to the latest commit after verifying the fix has been applied. Pending an official fix, implement Web Application Firewall (WAF) rules to detect script injection patterns in the 'reference' parameter, and reinforce Content Security Policy (CSP) headers to mitigate XSS impact.

Patch guidance

Check the mjperpinosa stumasy Git repository (commit history after 327d1b0f2915ba79d7ef8ebb74553e987609d9be) for patches addressing input validation in add_into_dictionary.php. Since this project does not use traditional versioning, establish a process to monitor commits and test against your deployed commit hash. When a fix is confirmed, pull the updated commit and redeploy. Verify the fix by confirming input sanitization is applied to the 'reference' parameter before output.

Detection guidance

Monitor web server logs for unusual patterns in requests to add_into_dictionary.php, particularly those containing HTML entities, script tags, or event handler syntax in the 'reference' parameter. Use SIEM rules to flag requests from authenticated users that include common XSS payloads. Application-level logging should capture add_definition calls with suspicious input. Endpoint Detection and Response (EDR) tools can identify anomalous browser behavior resulting from successful XSS exploitation.

Why prioritize this

Despite the low CVSS score, this vulnerability warrants attention because: (1) exploit code is publicly available, (2) the vendor has not yet responded, and (3) open-source projects with slow patch cycles may leave deployments exposed indefinitely. Organizations relying on mjperpinosa stumasy should treat this as a moderate-priority remediation task, not a critical emergency. The requirement for authentication and user interaction provides some natural containment.

Risk score, explained

The CVSS 3.1 score of 3.5 (LOW severity) reflects the combination of network accessibility (AV:N) with low attack complexity (AC:L), but is significantly constrained by the requirement for prior authentication (PR:L) and user interaction (UI:R). Integrity impact (I:L) is limited to the session or client-side context. No confidentiality or availability impact is present. The low score appropriately captures a vulnerability that is real but unlikely to enable broad compromise without additional attack steps.

Frequently asked questions