---
id: CVE-2026-54049
title: Sakai is a Collaboration and Learning Environment (CLE)
summary: >-
  Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to
  before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool
  stores topic and post messages without HTML sanitization, and the frontend
  renders…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-79
vendor: sakaiproject
product: sakai
affected:
  - 'sakai >= 23.0, < 23.5'
  - 'sakai >= 25.0, < 25.3'
published: '2026-10-01'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T03:17:03.230'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54049'
references:
  - url: >-
      https://github.com/sakaiproject/sakai/commit/2696b4b48cbef2e81512f52f84f7477adff78b27
    label: security-advisories@github.com
  - url: >-
      https://github.com/sakaiproject/sakai/security/advisories/GHSA-w2x5-gv52-9ccv
    label: security-advisories@github.com
  - url: >-
      https://github.com/sakaiproject/sakai/security/advisories/GHSA-w2x5-gv52-9ccv
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/sakaiproject/sakai/releases/tag/23.5'
  - url: 'https://github.com/advisories/GHSA-w2x5-gv52-9ccv'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - maven
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-06T02:08:15.317104Z'
epss: 0.00323
epssPercentile: 0.2516
aliases:
  - GHSA-w2x5-gv52-9ccv
ecosystem: maven
ingestedAt: '2026-08-24T20:10:47.312Z'
---

## Overview

Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML() directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post. This issue has been patched in versions 23.5, 25.3, and 26.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54049)

Affected packages:

- `org.sakaiproject.conversations:sakai-conversations-impl >= 23.0, <= 23.3`
- `org.sakaiproject.kernel:sakai-kernel-impl >= 23.0, <= 23.3`
- `org.sakaiproject.rubrics:rubrics-impl >= 23.0, <= 23.3`

Source: https://github.com/advisories/GHSA-w2x5-gv52-9ccv