CVE-2026-90583kagisearch smallweb Query String Rendering sw.py index cross site scripting
Updated under an hour ago ()
Does this affect you?
It affects kagisearch smallweb. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The patch is named 00b68144e583f20a6b67e29cf01bc07f57979ffb. It is recommended to apply a patch to fix this issue. Exploitability requires a raw HTTP request carrying unencoded double-quote characters in the query string - Werkzeug's request.query_string returns the raw request-target, and ordinary browsers percent-encode " as %22, so the payload only lands via netcat/curl-style raw sockets.
- CVSS
- 4.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C
- Weakness (CWE)
- CWE-79, CWE-94
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulDB
- NVD analysis
- Deferred
- Record last updated
- Sep 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
kagisearch smallweb kagisearch:smallweb | 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf | CNA record |
References
- https://vuldb.com/vuln/403168vdb-entry, technical-description
- https://vuldb.com/vuln/403168/ctisignature, permissions-required
- https://vuldb.com/cve/CVE-2026-90583third-party-advisory
- https://vuldb.com/submit/913779third-party-advisory
- https://github.com/kagisearch/smallweb/issues/854issue-tracking
- https://github.com/kagisearch/smallweb/commit/00b68144e583f20a6b67e29cf01bc07f57979ffbpatch
- https://github.com/kagisearch/smallweb/product
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.