Description

In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting (XSS) vulnerability is possible because Splunk SOAR can treat existing note content as Hypertext Markup Language (HTML) without sanitizing that content when the note format changes. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "Incident Commander" Splunk SOAR role should not be able to exploit the vulnerability at will. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.0",
  "pubDate": "2026-08-19T22:17:22.153Z",
  "pubdate": "2026-08-19T22:17:22.153Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability exists in Splunk SOAR versions below 8.6.0. The vulnerability allows an authenticated user assigned the 'Incident Commander' role to store malicious JavaScript within a note. When another user subsequently opens the affected note, the malicious script executes within the context of the victim's browser session.\nThe primary impact of this vulnerability is the potential execution of arbitrary JavaScript in the browser of unsuspecting users, which can lead to session hijacking, unauthorized actions performed within the application on behalf of the victim, or data theft. The risk implications are moderate to high depending on the privileges of the targeted user and the sensitivity of data accessible within the Splunk SOAR instance.\nExploitation of this vulnerability requires specific conditions and attacker capabilities. The attacker must possess the 'Incident Commander' role and successfully phish the targeted user by tricking them into initiating a specific request or navigation action within their browser to view the modified note content. Consequently, the attacker cannot exploit the vulnerability completely at will without user interaction.",
  "technicalDetails": "The vulnerability resides within the note management and rendering components of Splunk SOAR in versions below 8.6.0. The root cause is the improper handling and lack of sanitization of note content when the note format changes. Specifically, the application treats existing note content as Hypertext Markup Language (HTML) rather than neutral plain text or properly escaping dynamic input before rendering it in the Document Object Model (DOM).\nThe attack flow begins with an authenticated actor holding the 'Incident Commander' role. This user crafts a payload containing malicious JavaScript and stores it within a note object in Splunk SOAR. Because the underlying rendering engine processes note contents as HTML during format transitions without applying input sanitization or output encoding, the script is persisted directly into the application data store.\nTo trigger the execution phase, the attacker must employ social engineering techniques, such as phishing, to trick an affected user into initiating a request within their browser that opens or renders the compromised note. When the victim's browser processes the response containing the unsanitized HTML and JavaScript payload, the browser executes the script within the active security context and session of the victim.\nThe vulnerable component is the Splunk SOAR note parsing and display mechanism. Authentication and privilege requirements mandate that the initiating attacker hold the 'Incident Commander' role within Splunk SOAR. The network exposure is constrained to the web interface of the affected Splunk SOAR deployment. Post-exploitation impact includes the execution of arbitrary script actions within the victim's browser session, potentially compromising user integrity and session confidentiality."
}