CVE-2026-107798 Details
Description
jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to execute JavaScript when other users click or hover over rendered links.
A stored cross-site scripting vulnerability has been identified in Jivejdon versions from commit 595d8d22 through commit ee67a65e. This vulnerability resides in the default-enabled TextStyle filter, which improperly validates URLs before inserting them into anchor href attributes. As a result, authenticated attackers can exploit this by posting messages containing javascript: links or URLs that break out of the quoting context. When other users click or hover over these rendered links, the embedded JavaScript is executed.
Users can update to a version of Jivejdon that has addressed this vulnerability. The latest version can be obtained from the Jivejdon GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/banq/jivejdon | [email protected] | Source CodeVendor |
| https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/domain/model/message/output/html/TextStyle.java#L242-L243 | [email protected] | Source CodeVendor |
| https://github.com/banq/jivejdon/issues/28 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-stored-xss-via-markdown-links-in-textstyle-rendering-filter | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| banq jivejdon | >= 595d8d22, <= ee67a65e |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |