VYPR
← All advisories
Moderate severityNVD Advisory· Published Nov 21, 2022· Updated Apr 14, 2025

Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi

CVE-2022-4105

Description

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Stored XSS in Kiwi TCMS Test Plan allows attackers to execute arbitrary JavaScript via crafted input, leading to clickjacking and history page disruption.

Vulnerability

CVE-2022-4105 is a stored cross-site scripting (XSS) vulnerability in the Kiwi TCMS Test Plan functionality. The root cause is insufficient sanitization of user-supplied HTML when generating history diffs, allowing malicious JavaScript to persist and execute in the context of other users' sessions [1].

Exploitation

An attacker with the ability to create or modify test plans can inject malicious HTML and JavaScript. When other users navigate to the history diff page, the injected script executes without proper sanitization [2]. The attack does not require special privileges beyond being an authenticated user with test plan edit permissions.

Impact

Successful exploitation enables the attacker to perform UI redressing attacks (clickjacking) and disable the use of the history page, potentially leading to further account compromise or disruption of testing workflows [1].

Mitigation

The vulnerability has been patched in commit a2b169ffdef1d7c1755bade8138578423b35011b [2], which applies input sanitization via the bleach_input function. Users are advised to update Kiwi TCMS to a version containing this fix. No workarounds were announced for earlier versions.

References
  1. NVD - CVE-2022-4105
  2. Clean HTML input when generating history diff · kiwitcms/Kiwi@a2b169f

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
kiwitcmsPyPI
< 11.611.6

Affected products

2

Patches

1
a2b169ffdef1

Clean HTML input when generating history diff

https://github.com/kiwitcms/kiwiAlexander TodorovNov 7, 2022via ghsa
commit
1 file changed · +9 −0
  • tcms/core/history.py+9 −0 modified
    @@ -8,6 +8,8 @@
 from simple_history.admin import SimpleHistoryAdmin
 from simple_history.models import HistoricalRecords
 
+from tcms.core.templatetags.extra_filters import bleach_input
+
 
 def diff_objects(old_instance, new_instance, fields):
     """
@@ -20,6 +22,13 @@ def diff_objects(old_instance, new_instance, fields):
         field_diff = []
         old_value = getattr(old_instance, field.attname)
         new_value = getattr(new_instance, field.attname)
+
+        # clean stored XSS
+        if isinstance(old_value, str):
+            old_value = bleach_input(old_value)
+        if isinstance(new_value, str):
+            new_value = bleach_input(new_value)
+
         for line in difflib.unified_diff(
             str(old_value).split("\n"),
             str(new_value).split("\n"),

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.