CVE-2026-54694
SkillTree, a micro‑learning platform, has a critical flaw that lets an attacker inject malicious HTML and JavaScript through user registration fields. The unsanitized input is later rendered with Vue’s v‑html, allowing the attacker to run arbitrary code in an administrator’s browser. The vulnerability also enables remote script loading and cross‑site request forgery token theft without any phishing or admin interaction.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
SkillTree versions earlier than 4.4.2. Administrators who view quiz runs and users who can register accounts are affected.
Real-world impact
An attacker can execute arbitrary JavaScript in an admin’s browser, load malicious scripts from their own server, delete or create projects, create backdoor accounts, dump user data, install keyloggers, and steal XSRF tokens to perform privileged actions on the platform.
Why this severity
The CVSS score of 9.6 reflects a network‑accessible attack (AV:N) that requires low effort (AC:L) and no privileges (PR:N). The vulnerability changes the scope (S:C) and allows high confidentiality and integrity impact, while availability is only low. The UI requirement (UI:R) means the attacker must trick an admin into viewing a page, but the exploit chain is automatic once the admin opens the quiz runs page.
What to do about it
- 01Upgrade SkillTree to version 4.4.2 or later.
NVD description
Timeline
- Sep 9, 2026 · 4d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 9, 2026 · 4d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.