Vulnerability · Published Apr 17, 2026 · Assigned by GitHub_M

CVE-2026-40479Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget

Medium 5.4

In plain English

A medium-severity cross-site scripting in kimai from kimai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 89.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kimai is an open-source time tracking application. In versions 1.16.3 through 2.52.0, the escapeForHtml() function in KimaiEscape.js does not escape double quote or single quote characters. When a user's profile alias is inserted into an HTML attribute context via the team member form prototype and rendered through innerHTML, this incomplete escaping allows HTML attribute injection. An authenticated user with ROLE_USER privileges can store a malicious alias that executes JavaScript in the browser of any administrator viewing the team form, resulting in stored XSS with privilege escalation. This issue has been fixed in version 2.53.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	kimai/kimai	2.53.0	GHSA-g82g-m9vx-vhjg

Affected products (as reported)

Vendor	Product	Versions
kimai	kimai	>= 1.16.3, < 2.53.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/kimai/kimai/security/advisories/GHSA-g82g-m9vx-vhjg x_refsource_CONFIRM
https://github.com/kimai/kimai/releases/tag/2.53.0 x_refsource_MISC