Vulnerability · Published Feb 20, 2026 · Assigned by GitHub_M

CVE-2026-27169OpenSift: Persistent XSS Chat Tool Rendering

High 8.9

In plain English

A high-severity cross-site scripting in OpenSift from OpenSift. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)8.9High

Exploit odds (30 days)0.4%top 66.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-alpha and below render untrusted user/model content in chat tool UI surfaces using unsafe HTML interpolation patterns, leading to XSS. Stored content can execute JavaScript when later viewed in authenticated sessions. An attacker who can influence stored study/quiz/flashcard content could trigger script execution in a victim’s browser, potentially performing actions as that user in the local app session. This issue has been fixed in version 1.1.3-alpha.

Affected products (as reported)

Vendor	Product	Versions
OpenSift	OpenSift	< 1.1.3-alpha

Weakness: CWE-79, CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

References

https://github.com/OpenSift/OpenSift/security/advisories/GHSA-qrpx-7cmv-5gv5 x_refsource_CONFIRM
https://github.com/OpenSift/OpenSift/releases/tag/v1.1.3-alpha x_refsource_MISC