CVE-2026-34598 — yeswiki/yeswiki
CVE-2026-34598 is a Cross-site Scripting (XSS) vulnerability in yeswiki/yeswiki. A fix is available for yeswiki/yeswiki — see the affected versions and patch details below.
YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-34598.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Real-World Exposure
yeswiki/yeswikiReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Summary
A stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected page, the JavaScript payload gets executed.
Type: Stored and Blind Cross-Site Scripting (XSS) Affected Component: form title input field Authentication Required: No (Unauthenticated attack possible) Impact: Arbitrary JavaScript execution in victim’s browser
Details
A Stored XSS vulnerability occurs when an application stores malicious user input (in this case, a script injected via the form title field) in its backend database and renders it later on a page viewed by other users without proper sanitization or encoding.
In this case, the attacker can inject JavaScript payloads in the title field of a form, which the application stores in the database. When any user, such as an admin or another visitor, views the page that displays this title, the malicious script executes in their browser context.
PoC
- Visit
https://yeswiki.net/?BazaR&vue=formulaireorlocalhost/?BazaR&vue=formulaireorhttps://ferme.yeswiki.net/[username]/?BazaR&vue=formulaire - Click on the
+icon to add a record via theDiaryform. - Inject the payload like:
<script>alert(document.cookie)</script>or<script>alert(1)</script>intoName of the eventandDescription - Then save the record by clicking
To validate - The payload will be executed when anyone visits
/?BazaR&vue=consulteralso in the diary record/?wiki=BazaR&vue=consulter&action=recherche&q=&id=2&facette=
The payload is persistant.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | yeswiki/yeswiki | all versions | 4.6.0composer require yeswiki/yeswiki:^4.6.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for yeswiki/yeswiki, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update yeswiki/yeswiki to 4.6.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-34598 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2026-34598 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2026-34598. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-34598 in your dependencies?
O3 Security finds CVE-2026-34598 across Packagist dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.