CVE-2026-15321: MyEMS Admin Backend XSS Vulnerability – Patch to 6.5.0

Technical summary

The vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) occurs in MyEMS' Admin Backend SVG handling code. The on_post function in myems-api/core/svg.py accepts user input through the new_values['data'] parameter without adequate input validation or output encoding. This allows an authenticated administrator to inject arbitrary JavaScript that persists in the application's data store. When other users access the affected SVG or related administrative interface, their browsers execute the injected script in the context of the MyEMS application, potentially allowing session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. CWE-94 (Improper Control of Generation of Code) indicates secondary code injection concerns.

Business impact

The practical impact depends on your MyEMS deployment and the privileges of potential attackers. Since exploitation requires high-privilege administrator credentials, the risk profile is primarily around insider threats or compromised admin accounts. A malicious admin could inject scripts to capture credentials from other administrators, modify system settings covertly, or establish persistence. For organizations running MyEMS in multi-tenant or shared administrative environments, this represents a lateral privilege escalation and data exfiltration vector. Single-admin deployments face lower risk but should not ignore the threat, especially if admin credentials could be exposed through phishing or other means.

Affected systems

MyEMS versions 6.4.0 and earlier are vulnerable. The affected component is the Admin Backend API, specifically the SVG handling functionality. Organizations running MyEMS for energy management or related operations should audit their deployment versions immediately. Version 6.5.0 and later include the fix (commit 4a97edfbd786c779d0322054833b21ddf54d5b06) and should be treated as the target remediation version.

Exploitability

The vulnerability is exploitable but requires a high bar for real-world attacks. An attacker must possess valid administrator credentials to access the affected API endpoint, and the payload injection occurs through deliberate manipulation of the new_values parameter. The user interaction requirement (UI:R in the CVSS vector) indicates that a second user must view or interact with the infected data for script execution to occur. The public availability of an exploit proof-of-concept means automated scanning tools may soon identify vulnerable instances, increasing detection risk for unpatched systems. However, the need for admin-level access keeps the attack surface relatively constrained.

Remediation

Upgrade MyEMS to version 6.5.0 or later, which includes commit 4a97edfbd786c779d0322054833b21ddf54d5b06. If immediate upgrading is not possible, restrict administrative access to the MyEMS API to trusted users only, disable API access if the SVG functionality is not required, and monitor admin accounts for suspicious activity. Input validation and output encoding on the new_values['data'] parameter should be reviewed even after patching to ensure defense-in-depth.

Patch guidance

Upgrade to MyEMS version 6.5.0 or later. Verify the patch version against the vendor's official release notes to confirm the vulnerable commit 4a97edfbd786c779d0322054833b21ddf54d5b06 has been replaced. Test the upgrade in a non-production environment first, especially if your MyEMS instance has custom SVG configurations or extensions. After patching, audit application logs for any evidence of suspicious admin account activity during the window of vulnerability exposure. Consider clearing cached data and requiring re-authentication of all sessions to invalidate any potentially compromised administrator tokens.

Detection guidance

Review MyEMS Admin Backend API logs for POST requests to the affected svg.py on_post endpoint with suspicious new_values['data'] payloads, particularly those containing script tags, event handlers (onclick, onload), or encoded JavaScript. Monitor for unusual administrative account activity, especially accounts that do not typically interact with SVG or configuration features. Inspect the SVG data store directly for embedded script content or HTML entities that may indicate injection attempts. Web application firewalls (WAF) configured with XSS detection rules should flag malicious payloads in the new_values parameter. Forensic analysis of browser caches or application-rendered SVG files may reveal stored XSS artifacts.

Why prioritize this

Despite the low CVSS score, this vulnerability merits attention in any organization running MyEMS because: (1) the exploit is publicly available, raising the likelihood of automated discovery and attempted exploitation; (2) administrative credentials, while restrictive, are not uncommon in breached environments or insider threat scenarios; (3) the XSS payload persists in stored data, creating a continuous threat to all users of the system; and (4) the issue report remains open, suggesting active monitoring by security researchers may continue. Prioritize patching if you have evidence of compromised admin credentials or if your MyEMS instance is internet-facing, even though the latter is uncommon.

Risk score, explained

The CVSS 3.1 score of 2.4 (LOW) reflects a narrow attack vector: Network-based, but requiring High Privilege and user interaction. The impact is limited to integrity (the ability to inject scripts) with no confidentiality or availability impact captured by the base score. However, the real-world risk is higher than the score suggests due to the public exploit availability and the transitive nature of stored XSS—once injected, the payload affects all users. The low score should not trigger alert fatigue, but it should not be dismissed in threat-driven prioritization, particularly in organizations where admin compromise is a credible threat model.

Frequently asked questions