CVE-2026-41250
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Taiga prior to 6.9.1 is vulnerable to stored XSS. This vulnerability is fixed in version 6.9.1.
Risk Assessment
This may allow an attacker to execute arbitrary JavaScript in the victim's browser, leading to session theft or other attacks.
Recommendation
Update Taiga to version 6.9.1 or later.
Other vulnerabilities in Taiga
See all- CVE-2026-65055Medium
Vulnerability in Taiga 6.10.1 due to missing authorization in filters_data API endpoints. An unauthenticated attacker can disclose the full member roster and workflow configuration of private projects by supplying a project ID.
- CVE-2026-59097Medium
Taiga before version 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project. The attack exploits unprotected POST endpoints on the user-story, task, and issue due-date API viewsets.
- CVE-2025-62367Medium
Taiga, an open source project management platform, in versions 6.8.3 and earlier is vulnerable to time-based blind SQL injection, allowing sensitive data disclosure via response timing. This issue is fixed in version 6.9.0.
Original NVD description (English source)
Taiga is a project management platform for startups and agile developers. Prior 6.9.1, Taiga front is vulnerable to stored XSS. This vulnerability is fixed in 6.9.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS