{"id":"CVE-2026-105456","title":"Stored XSS via HTML scrubber rule in RTIR","summary":"RTIR extends RT's HTML scrubber to allow an internal link\n      placeholder, and the extension lets through any link that merely\n      contains the placeholder, including links using the executable\n      javascript: scheme. The change ap…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"Best Practical Solutions","product":"RT for Incident Response","affected":["rt_for_incident_response >= 5.0.0 < 5.0.11","rt_for_incident_response >= 6.0.0 < 6.0.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T17:05:31.942517Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T17:18:22.375Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105456","references":[{"url":"https://cert.pl/en/posts/2026/10/CVE-2026-105454"},{"url":"https://requesttracker.com/rtir/"}],"tags":["cve.org"],"epss":0.0045,"epssPercentile":0.39237,"ingestedAt":"2026-11-05T16:24:31.165Z","slug":"CVE-2026-105456","body":"## Overview\n\nRTIR extends RT's HTML scrubber to allow an internal link\n      placeholder, and the extension lets through any link that merely\n      contains the placeholder, including links using the executable\n      javascript: scheme. The change applies to the whole RT instance\n      once RTIR is installed, not only to RTIR's own queues. Anyone who\n      can add HTML content to a ticket on such an instance can store\n      such a link. That includes an unauthenticated sender of HTML email\n      to the Incident Reports queue, which RTIR opens to everyone by\n      default. Script runs when a user clicks the link, in that user's\n      session, and can act in RT with that user's authority.\n\n\nThis issue was fixed in version 5.0.11 and 6.0.4\n\n## Affected\n\n- `rt_for_incident_response >= 5.0.0 < 5.0.11`\n- `rt_for_incident_response >= 6.0.0 < 6.0.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}