Vulnerability · Published Oct 13, 2026 · Assigned by INCIBE
CVE-2026-96535Cross-Site Scripting in the YouMind web application
Medium 5.1
In plain English
A medium-severity cross-site scripting in YouMind web application from YouMind. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN’s domain.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| YouMind | YouMind web application | 0 – before 13/10/2026 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N