CVE-2026-5468: Casdoor Vulnerable to Stored XSS via Application formCss / formSideHtml
Summary
CVE-2026-5468: Casdoor vulnerable to Stored XSS via Application formCss / formSideHtml. Affects github.com/casdoor/casdoor versions < 1.1000.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Casdoor is an open-source identity and access management platform designed to provide user authentication and authorization services. It enables developers to integrate user management features into their applications easily. The platform supports various authentication methods and offers a customizable interface. However, a vulnerability has been identified in version 2.356.0, which exposes users to potential cross-site scripting (XSS) attacks due to improper handling of user input in the application.
Vulnerability Detail
The vulnerability arises from the function dangerouslySetInnerHTML, which is used to render HTML content directly from user input without proper sanitization. By manipulating the arguments formCss, formCssMobile, or formSideHtml, an attacker can inject malicious scripts that execute in the context of the user's browser. This can lead to unauthorized actions, data theft, or session hijacking. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), and it can be exploited remotely, making it a significant security concern.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize user inputs before rendering them in your application. Implement input validation and escaping mechanisms to prevent the execution of malicious scripts. For example, use libraries like 'html/template' in Go to safely render HTML content.
Conclusion
The vulnerability identified as CVE-2026-5468 in Casdoor poses a risk of stored XSS attacks due to improper handling of user inputs. It is crucial for users of the affected version to update to the latest patched version to mitigate this risk. Additionally, implementing input validation and sanitization can help protect against potential exploits.
See every vulnerability recorded for github.com/casdoor/casdoor →
FAQ
The vulnerability is a stored XSS issue that allows attackers to inject malicious scripts into the application.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and session hijacking.
Yes, a patched version (2.356.1 or higher) is available. It is recommended to update your package to this version.
The CVSS score of this vulnerability is 3.5, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/casdoor/casdoor.
