CVE-2026-90583

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The patch is named 00b68144e583f20a6b67e29cf01bc07f57979ffb. It is recommended to apply a patch to fix this issue. Exploitability requires a raw HTTP request carrying unencoded double-quote characters in the query string - Werkzeug's request.query_string returns the raw request-target, and ordinary browsers percent-encode " as %22, so the payload only lands via netcat/curl-style raw sockets.

• CWE-79
• CWE-94

• https://github.com/kagisearch/smallweb/
• https://github.com/kagisearch/smallweb/commit/00b68144e583f20a6b67e29cf01bc07f57979ffb
• https://github.com/kagisearch/smallweb/issues/854
• https://vuldb.com/cve/CVE-2026-90583
• https://vuldb.com/submit/913779
• https://vuldb.com/vuln/403168
• https://vuldb.com/vuln/403168/cti
• https://github.com/kagisearch/smallweb/issues/854

Published

Sep 13, 2026

Last Modified

Sep 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90578A flaw has been found in GPAC up to f1219cde. Affected by th…5.3
• CVE-2026-90579A vulnerability has been found in cheshire-cat-ai Cheshire C…7.3
• CVE-2026-9058For untrusted certificates that contain the "Authority Infor…9.3
• CVE-2026-90580A vulnerability was found in FlowiseAI Flowise up to 3.0.2. …6.3
• CVE-2026-90581A vulnerability was determined in cym1102 nginxWebUI up to 4…6.3
• CVE-2026-90582A vulnerability was identified in evanchiu serverless-todo 1…5.3
• CVE-2026-90584A weakness has been identified in TooTallNate Java-WebSocket…5.3
• CVE-2026-9059NextGEN Gallery version prior to 4.2.1 are vulnerable to aut…9.3
• CVE-2026-90593A vulnerability was determined in embedded-graphics up to 0.…7.3
• CVE-2026-90594A vulnerability was identified in wxiaoqi Spring-Cloud-Platf…6.3
• CVE-2026-90595A security flaw has been discovered in wxiaoqi Spring-Cloud-…6.3
• CVE-2026-90596A weakness has been identified in embedded-graphics up to 0.…6.5