Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:LSummary
CVE-2026-27169 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Opensift Opensift. Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Other ATLAS/OWASP Terms risk domain.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-27169 is a cross-site scripting (XSS) vulnerability affecting OpenSift, an AI study tool that uses semantic search and generative AI to process large datasets. Versions 1.1.2-alpha and below render untrusted user or model-generated content in chat tool UI surfaces via unsafe HTML interpolation patterns. This improper encoding (CWE-116, CWE-79) allows stored content to execute arbitrary JavaScript when viewed in authenticated sessions. The vulnerability was published on 2026-02-21 and carries a CVSS v3.1 base score of 8.9 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L).
An attacker requires low privileges (PR:L) to influence stored study, quiz, or flashcard content, such as by injecting malicious payloads via user inputs or AI-generated outputs. Exploitation occurs over the network (AV:N) with low complexity when a victim with an authenticated session views the tainted content, requiring user interaction (UI:R). Successful attacks trigger JavaScript execution in the victim's browser with changed scope (S:C), enabling high-impact actions like data exfiltration (C:H), session manipulation (I:H), or limited disruption (A:L) as the victim within the local app session.
The issue is fixed in OpenSift version 1.1.3-alpha. Mitigation details are available in the GitHub release notes at https://github.com/OpenSift/OpenSift/releases/tag/v1.1.3-alpha and the security advisory at https://github.com/OpenSift/OpenSift/security/advisories/GHSA-qrpx-7cmv-5gv5, which practitioners should review for upgrade instructions and any interim workarounds.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7746
Vulnerability Data
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-alpha and below render untrusted user/model content in chat tool UI surfaces using unsafe HTML interpolation patterns, leading to XSS. Stored content…
more
can execute JavaScript when later viewed in authenticated sessions. An attacker who can influence stored study/quiz/flashcard content could trigger script execution in a victim’s browser, potentially performing actions as that user in the local app session. This issue has been fixed in version 1.1.3-alpha.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- AI-specific weaknesses CR
- CWE-1426 — Generative model output reaches DOM sink without validation (XSS).
Mapped by Cyber Resilience · not in NVD. Poisoning and extraction cases are routed to MITRE ATLAS instead of a synthetic CWE.- Classification Reason
- Matched keywords: ai, generative ai
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.2V1.2.1V1.2.3V1.3.2
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing or incorrect input neutralization through targeted web-application tests.
Input validation directly enforces neutralization of untrusted data before it reaches web output generation.
Output filtering can catch or sanitize unneutralized script content before it is served to users.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly target introduction of XSS via coding standards/testing (mostly), yet the single broad outcome leaves many specific neutralization vectors unaddressed (partial).
Patching and EOL replacement can remediate known XSS instances in libraries or frameworks (partial) but do nothing to enforce input neutralization in application code (none).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards explicitly require correct output encoding and escaping to preserve message structure.
Secure-coding testing and automated code-analysis tools are applied to detect improper neutralization of script-related content during web-page generation.
Knowledge exchange on emerging attack techniques and patches reduces the likelihood that cross-site scripting flaws remain unaddressed in deployed applications.
Operational indicators of compromise for web-application attacks can be incorporated into WAF or input-filtering rules, lowering the likelihood that unsanitized data reaches the browser.
Requiring language-specific secure-coding standards and automated scanning during the SDLC catches missing output encoding or improper neutralization of untrusted data before the software reaches production.
Application security requirements include explicit rules for safe output handling and encoding.