Hall of Fame image from https://openclipart.org/detail/120343/trophy
Back to Hall of Fame Contents Back to Wekan Website

Contents / SourceBleed

CVE Vulnerability name Date Responsible Security Disclosure by Vulnerabilities
-

SourceBleed

2026-07-19 meifukun (GitHub) and xet7 (fix)

Privately reported 8 issues reviewed against WeKan v9.95.0.
  • SourceBleed — a Trello board imported with a javascript: url had that URL stored as an activity source.url (models/trelloCreator.js) and rendered as an activity-sidebar link (client/components/activities/activities.js) with no scheme check, so a board admin who clicked the "Trello" source link ran attacker JavaScript in their session and could read Meteor.loginToken (stored XSS → account takeover). Fixed by only storing and linking http(s) source URLs (CWE-79 Stored Cross-site Scripting)
  • Reported privately by meifukun (https://github.com/meifukun)
  • Fixed at upcoming WeKan release
  • More details


Details

SourceBleed — CWE-79 Stored Cross-site Scripting

a Trello board imported with a javascript: url had that URL stored as an activity source.url (models/trelloCreator.js) and rendered as an activity-sidebar link (client/components/activities/activities.js) with no scheme check, so a board admin who clicked the "Trello" source link ran attacker JavaScript in their session and could read Meteor.loginToken (stored XSS → account takeover). Fixed by only storing and linking http(s) source URLs.

Reported privately by meifukun (https://github.com/meifukun), who reviewed 8 issues against WeKan v9.95.0 (commit f602b9459fa1622f60ee8c3b639f02035f3ab32b) on local self-hosted instances only. Fixed at the upcoming WeKan release.