Description

Cross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-17T18:17:09.100Z",
  "pubdate": "2026-08-17T18:17:09.100Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in Squirro Cognitive Search prior to version 3.14.2, allowing remote attackers to execute arbitrary code via the Email Notification, Create Evaluation Sets, and HTML Editor functions.\nThis security flaw exposes the application to malicious script injection, potentially compromising user sessions, integrity, and confidentiality.\nThe affected product is Squirro Cognitive Search versions below 3.14.2.\nThe risk implications include unauthorized script execution within the context of a victim's browser session, leading to potential session hijacking or data exfiltration.\nA remote attacker with the capability to interact with the vulnerable application functions can exploit this flaw.\nExploitation requires the attacker to supply malicious input through the identified vulnerable functions where user-supplied data is improperly sanitized or encoded before being rendered to the user.",
  "technicalDetails": "The vulnerability is a Cross-Site Scripting (XSS) flaw localized within specific functional components of Squirro Cognitive Search prior to version 3.14.2, specifically affecting the Email Notification, Create Evaluation Sets, and HTML Editor functions.\nThe root cause stems from insufficient input sanitization and output encoding of untrusted user-supplied data, allowing malicious payloads to be injected and subsequently executed by the client browser.\nThe affected components are the Email Notification, Create Evaluation Sets, and HTML Editor modules, which fail to properly neutralize executable script content.\nAffected versions comprise all deployments of Squirro Cognitive Search running versions strictly less than 3.14.2.\nThe attack vector is network-based, requiring remote interaction where an attacker supplies malicious script payloads into the vulnerable input fields or functions.\nStep-by-step exploitation occurs as follows: first, the attacker crafts a malicious payload containing arbitrary JavaScript or HTML code. Second, the attacker submits this payload via the Email Notification, Create Evaluation Sets, or HTML Editor functions. Third, the application stores or reflects the unsanitized input without proper contextual output encoding. Finally, when a victim accesses the affected functionality, the browser executes the injected script within the security context of the victim's active session.\nThe post-exploitation impact includes the execution of arbitrary code, session hijacking, unauthorized actions performed on behalf of the victim, and potential access to sensitive interface data."
}