Is CVE-2026-42197 actively exploited?

No active exploitation of CVE-2026-42197 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-42197 be exploited remotely?

Yes. CVE-2026-42197 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-42197?

CVE-2026-42197 has a CVSS score of 8.7 (HIGH).

HOME VULNERABILITIESCVE-2026-42197

HIGH

CVE-2026-42197

CWE-79Published: May 27, 2026· Updated: Jun 1, 2026

8.7

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:9.3th

Official Description

RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 have a stored cross-site scripting vulnerability that allows any enrolled student to execute arbitrary JavaScript in an administrator's browser session, potentially leading to full admin account takeover. The `get_user()` method in `ParticipationAdmin` renders user-controlled input using `mark_safe` combined with Python's % string formatting. This bypasses Django\'s automatic HTML escaping entirely. The value returned by `get_full_name` is derived directly from the `first_name` and `last_name` fields of the User model. These fields are freely editable by any authenticated user through the profile page (`/profile/`) with no sanitization applied. When an admin views the Participation list in the Django admin panel, the unsanitized value is rendered directly into the HTML response, causing the injected script to execute in the admin's browser. Commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 fixes the issue.

NVD Source

Technical Analysis

CVE-2026-42197 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.7.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.