Description

Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A board member could store an entity-encoded event-handler payload in a card title that remained inert on the live board but was reparsed and executed when a recipient clicked the card in the downloaded HTML export, allowing the script to read and transmit all board data contained in that export, including content added after the attacker's membership was removed. Version 10.23 builds the modal with DOM nodes and assigns untrusted values through textContent. This issue is fixed in version 10.23.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-19T20:17:21.727Z",
  "pubdate": "2026-08-19T20:17:21.727Z",
  "executiveSummary": "An authenticated DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Wekan open-source kanban application, specifically affecting versions 8.72 through 10.23. The vulnerability stems from insecure data handling within the board export functionality implemented in client/lib/exportHTML.js. A malicious board member can leverage this flaw by storing an entity-encoded event-handler payload within a card title. While this payload remains inert within the live collaborative board environment, it executes arbitrary JavaScript code when a victimized user opens the downloaded HTML export and interacts with the specific card within the rendered modal. Successful exploitation grants an attacker the capability to execute malicious scripts within the context of the victim's local browser session, enabling unauthorized access, exfiltration, and transmission of all sensitive board data contained within the export archive. This risk persists even for data added subsequent to the revocation of the attacker's board membership, due to the static and self-contained nature of the exported artifact. Mitigation requires upgrading the affected deployment to version 10.23, which remediates the issue by constructing interface modals safely via DOM nodes and assigning untrusted user-supplied values exclusively through textContent assignment.",
  "technicalDetails": "The vulnerability resides in the addBoardHTMLToZip() function located within the client/lib/exportHTML.js file of the Wekan application. Within versions 8.72 to 10.23, the application processes card titles and bodies by reading them through textContent, which inherently decodes entity-encoded markup. Following this decoding process, the resulting titleText and allText variables are directly interpolated into the content.innerHTML property during the generation of the exported index.html file. This unsafe assignment pattern creates a classic DOM-based Cross-Site Scripting vector during the rendering phase of the static archive. The attack flow commences when an authenticated user with board membership privileges stores a meticulously crafted, entity-encoded event-handler payload inside a card title or body. Because the live application handles rendering securely, the malicious payload remains completely dormant and does not trigger execution on the active board interface. However, when any user initiates a board export, downloads the resulting ZIP archive, and subsequently triggers the display of the affected card by clicking it within the local index.html export, the browser reparses the entity-encoded payload injected into content.innerHTML. This dynamic re-evaluation forces the execution of the embedded event handler script. The privileges required for payload injection are limited to standard board membership, allowing malicious actors to plant persistent triggers. Once executed, the malicious script operates with the full context of the local document, enabling it to read, access, and transmit all sensitive board data contained inside that specific export. Furthermore, because the export captures a static snapshot of the board state at a given time, this compromised export retains the capacity to expose information—including data appended after the attacker's board membership permissions have been explicitly revoked."
}