CVE-2026-27614 — AI Deep Analysis Summary

🚨 **Essence**: Bugsink < 2.0.13 suffers from **Stored XSS** (CWE-79). 📉 **Consequences**: Attackers inject malicious JS into bug reports. When admins view stack traces, the script executes in their browser.…

🛡️ **Root Cause**: **CWE-79** (Improper Neutralization of Input During Web Page Generation). ❌ **Flaw**: The application fails to sanitize user-submitted event descriptions.…

🎯 **Affected**: **Bugsink** (Self-hosted Bug Tracking Software). 📦 **Versions**: All versions **prior to 2.0.13**. ✅ **Fixed**: Version 2.0.13 and later are safe. 🏢 **Vendor**: Bugsink.

💻 **Actions**: Execute arbitrary JavaScript in the context of the **Admin** user. 🕵️ **Privileges**: Steal admin cookies/sessions, redirect admins, or perform actions on behalf of the admin.…

⚖️ **Threshold**: **Medium**. 🌐 **Network**: Remote (AV:N). 🔑 **Auth**: No authentication required to submit events (PR:N). 🖱️ **User Interaction**: Required (UI:R) – An admin must click/view the infected stack trace.…

🚫 **Public Exploit**: **No**. 📝 **PoC**: The `pocs` array is empty in the data. 📢 **Status**: Advisory published (GHSA-vp6q-7m36-pq3w), but no specific code exploit is publicly available yet.…

🔍 **Self-Check**: Scan for **Bugsink** instances. 📋 **Verify Version**: Check if the running version is **< 2.0.13**. 🧪 **Test**: Try submitting a bug report with a simple `<script>alert(1)</script>` payload.…

✅ **Fixed**: **Yes**. 🔄 **Patch**: Upgrade to **Bugsink 2.0.13** or later. 🔗 **Source**: See GitHub release notes and commit `e784d6aeb0d5f29b40c2779d2544c2b9ef097ee9`.…

🚧 **No Patch Workaround**: 1. **Restrict Access**: Limit who can submit events (if possible). 2. **Monitor**: Alert admins to inspect new reports carefully. 3.…

⚠️ **Priority**: **High**. 🚀 **Urgency**: CVSS Score is **High** (C:H, I:H). 📅 **Published**: Feb 25, 2026.…