Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in ConversationsServiceImpl, whose saveTopic, savePost, and saveComment methods persist the submitted message field without passing it through FormattedText.processFormattedText, while the frontend renders those...

CVE-2026-54049

Sakai is a Collaboration and Learning Environment CLE. From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML directive, resulting in...

EUVD-2026-91027

Sakai is a Collaboration and Learning Environment CLE. From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML directive, resulting in...

CVE-2026-54049: Improper Neutralization of Input During Web Page Generation

Sakai is a Collaboration and Learning Environment CLE. From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML directive, resulting in...