Description

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The patch is named 00b68144e583f20a6b67e29cf01bc07f57979ffb. It is recommended to apply a patch to fix this issue. Exploitability requires a raw HTTP request carrying unencoded double-quote characters in the query string - Werkzeug's request.query_string returns the raw request-target, and ordinary browsers percent-encode " as %22, so the payload only lands via netcat/curl-style raw sockets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-13T20:16:51.837Z",
  "pubdate": "2026-09-13T20:16:51.837Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the Query String Rendering component of the kagisearch smallweb application.\nThe flaw stems from improper sanitization of input within the index function of app/sw.py, allowing for the injection of malicious scripts into the web page response.\nSuccessful exploitation enables an attacker to execute arbitrary JavaScript in the victim's browser context, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of the user.\nThe vulnerability is remotely exploitable, though it requires specific conditions for triggering.\nBecause the application follows a rolling release model, all versions up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf are considered affected.\nExploitation is non-trivial via standard browsers due to automatic percent-encoding of control characters; however, attackers can bypass this by using raw HTTP request tools such as netcat or curl to transmit unencoded payloads.",
  "technicalDetails": "The vulnerability resides in the index function within app/sw.py, specifically in how the application processes the 'qs' (query string) argument.\nThe root cause is the insecure reflection of user-supplied input from the raw request query string into the HTTP response body without adequate encoding or validation.\nThe application utilizes Werkzeug to handle requests. A critical technical detail is that request.query_string returns the raw request-target, which contains the original, unparsed query parameters.\nUnder normal circumstances, modern web browsers automatically percent-encode characters such as double-quotes (\") as '%22', which neutralizes the ability to break out of HTML attributes. However, because the application processes the raw request-target, an attacker can bypass browser-side sanitization by utilizing command-line tools like curl or netcat to craft an HTTP request containing literal, unencoded double-quote characters.\nThe attack flow proceeds as follows: 1) The attacker constructs a raw HTTP GET or POST request targeting the affected endpoint. 2) The attacker inserts a malicious payload into the 'qs' argument, such as ?qs=\"><script>alert(1)</script>. 3) By sending this request via raw sockets, the literal '\"' character reaches the application server unencoded. 4) The server processes the input and reflects the malicious script directly into the HTML output generated by the index function. 5) When a user subsequently interacts with the modified page or the attacker tricks a user into loading the URL, the embedded JavaScript is executed by the victim's browser.\nThe impact of this Reflected XSS is significant, as it allows for the exfiltration of session cookies (if not protected by HttpOnly flags), redirection to malicious domains, and UI redressing. The exploitation does not require authentication or specific privilege levels, as it is a direct interaction with the application's public-facing rendering logic."
}