CVE-2026-54049
Description
Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML() directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post. This issue has been patched in versions 23.5, 25.3, and 26.0.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.sakaiproject.conversations:sakai-conversations-implMaven | 23.0 ≤ v ≤ 23.3 | — |
| org.sakaiproject.kernel:sakai-kernel-implMaven | 23.0 ≤ v ≤ 23.3 | — |
| org.sakaiproject.rubrics:rubrics-implMaven | 23.0 ≤ v ≤ 23.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.