CVE-2023-27489

Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS accepts SVG files uploaded by users which could potentially contain JavaScript code. If SVG images are viewed directly, i.e. not rendered in an HTML page, this JavaScript code could execute. This vulnerability has been fixed by configuring Kiwi TCMS to serve with the Content-Security-Policy HTTP header which blocks inline JavaScript in all modern browsers. This configuration change is provided in version 12.1 and users are advised to upgrade. Users unable to upgrade may set their Content-Security-Policy HTTP header manually.

• CWE-79

• https://github.com/kiwitcms/Kiwi/commit/6617cee0fb70cc394b7be6bbc86ef84e6e9de077Patch
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9jPatch, Vendor Advisory
• https://github.com/kiwitcms/Kiwi/commit/6617cee0fb70cc394b7be6bbc86ef84e6e9de077Patch
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9jPatch, Vendor Advisory

Published

Mar 29, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27483crossplane-runtime is a set of go libraries used to build Ku…7.5
• CVE-2023-27484crossplane-runtime is a set of go libraries used to build Ku…4.9
• CVE-2023-27485thmmniii/fbs-core is an open source feedback system for stud…4.3
• CVE-2023-27486xCAT is a toolkit for deployment and administration of compu…8.8
• CVE-2023-27487Envoy is an open source edge and service proxy designed for …9.1
• CVE-2023-27488Envoy is an open source edge and service proxy designed for …9.8
• CVE-2023-2749Download Center fails to properly validate the file path sub…7.5
• CVE-2023-27490NextAuth.js is an open source authentication solution for Ne…8.8
• CVE-2023-27491Envoy is an open source edge and service proxy designed for …9.1
• CVE-2023-27492Envoy is an open source edge and service proxy designed for …6.5
• CVE-2023-27493Envoy is an open source edge and service proxy designed for …9.1
• CVE-2023-27494Streamlit, software for turning data scripts into web applic…6.1