CVE-2026-50771
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Squirro Cognitive Search before 3.14.2 has a Cross Site Scripting (XSS) vulnerability that allows a remote attacker to execute arbitrary code via the Email Notification, Create Evaluation Sets and HTML Editor functions.
Risk Assessment
The risk includes execution of malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or other attacks.
Recommendation
It is recommended to upgrade to version 3.14.2 or later, which includes the fix.
Other vulnerabilities in Squirro Cognitive Search
See all- CVE-2026-50772Critical
An issue in Squirro Cognitive Search versions prior to 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload sent to the password reset function. The vulnerability can be exploited to take control of the application.
- CVE-2026-50770Critical
An issue in Squirro Cognitive Search before version 3.14.2 allows a remote attacker to escalate privileges via a crafted request. This vulnerability enables unauthorized elevation of access levels.
Original NVD description (English source)
Cross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS