Taguette Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Taguette versions prior to 1.5.0. This issue allows project members to inject JavaScript into name or description fields, which is executed when the project is loaded. The vulnerability arises because these fields are included as JSON in a JavaScript snippet without proper HTML sanitization, enabling the execution of arbitrary code.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, import a codebook containing a payload into a Taguette project. The injected JavaScript will execute immediately upon project load.

Remediation

Users are advised to upgrade to Taguette version 1.5.0.