CVE-2026-24903
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in OrcaStatLLM Researcher allows attackers to inject malicious JavaScript code through research topic inputs. This code executes in victims' browsers when they view session logs, potentially compromising user accounts and data. Users of OrcaStatLLM Researcher are affected.
💻 Affected Systems
- OrcaStatLLM Researcher
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Session hijacking, credential theft, and unauthorized actions performed in the context of logged-in users.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only affecting user interface elements.
🎯 Exploit Status
Exploitation requires ability to submit research topics, which typically requires some level of access to the application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check GitHub advisory for specific patched version
Vendor Advisory: https://github.com/AlgoNetLab/OrcaStatLLM-Researcher/security/advisories/GHSA-47wv-g894-82m4
Restart Required: Yes
Instructions:
1. Visit the GitHub security advisory
2. Update to the latest patched version
3. Restart the OrcaStatLLM Researcher application
4. Verify the fix by testing XSS payloads
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize research topic inputs before processing
Implement input sanitization in research topic handler
Output Encoding
allApply proper HTML encoding to log message outputs before rendering in browser
Encode user-controlled data in session page templates
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with XSS protection rules
- Disable or restrict access to the session page functionality
🔍 How to Verify
Check if Vulnerable:
Test by submitting a research topic with basic XSS payload like <script>alert('test')</script> and check if it executes in session logsCheck Version:
Check application version in settings or about pageVerify Fix Applied:
After patching, test the same XSS payload to confirm it's properly sanitized and doesn't execute📡 Detection & Monitoring
Log Indicators:
- Unusual research topic submissions containing script tags or JavaScript code
- Multiple failed XSS attempts in logs
Network Indicators:
- Unexpected JavaScript execution in session page responses
- Suspicious outbound connections from user browsers
SIEM Query:
Search for research_topic fields containing script tags or JavaScript patterns in application logs