CVE-2026-42197

RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 have a stored cross-site scripting vulnerability that allows any enrolled student to execute arbitrary JavaScript in an administrator's browser session, potentially leading to full admin account takeover. The `get_user()` method in `ParticipationAdmin` renders user-controlled input using `mark_safe` combined with Python's % string formatting. This bypasses Django\'s automatic HTML escaping entirely. The value returned by `get_full_name` is derived directly from the `first_name` and `last_name` fields of the User model. These fields are freely editable by any authenticated user through the profile page (`/profile/`) with no sanitization applied. When an admin views the Participation list in the Django admin panel, the unsanitized value is rendered directly into the HTML response, causing the injected script to execute in the admin's browser. Commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 fixes the issue.

• CWE-79

• https://github.com/inducer/relate/blob/550b8c54eb4d5f3e5f6698dcba361bf34d715599/course/admin.py#L347-L368
• https://github.com/inducer/relate/commit/555f0efb1c5bd7531c07cd73724d7e566a81f620
• https://github.com/inducer/relate/security/advisories/GHSA-37xm-vhx8-g6w3

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42191OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (Op…7.8
• CVE-2026-42192Plunk is an open-source email platform built on top of AWS S…5.4
• CVE-2026-42193Plunk is an open-source email platform built on top of AWS S…9.1
• CVE-2026-42194Admidio is an open-source user management solution. Prior to…6.8
• CVE-2026-42195draw.io is a configurable diagramming and whiteboarding appl…3.4
• CVE-2026-42196django-s3file is a lightweight file upload input for Django …9.9
• CVE-2026-42198pgjdbc is an open source postgresql JDBC Driver. From versio…7.5
• CVE-2026-42199Grid is a data structure grid for rust. From version 0.17.0 …6.2
• CVE-2026-4220A vulnerability has been found in Technologies Integrated Ma…7.3
• CVE-2026-42200Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-42201Coolify is an open-source and self-hostable tool for managin…3.3
• CVE-2026-42202nova-toggle-5 enables fliping booleans in the index. Prior t…6.5