CVE-2026-54049

The Sakai Collaboration and Learning Environment is vulnerable to stored cross-site scripting (XSS) in the Conversations tool (versions 23.0 to before 23.5, and 25.0 to before 25.3). The root cause is the lack of HTML sanitization when storing topic and post messages via the ConversationsServiceI...

GHSA-W2X5-GV52-9CCV Sakai Conversations has a Stored XSS Issue

Summary The Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML directive, resulting in stored cross-site scripting XSS. Any authenticated user with access to a site that has the Conversations tool enabled...

Sakai Conversations has a Stored XSS Issue

Summary The Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML directive, resulting in stored cross-site scripting XSS. Any authenticated user with access to a site that has the Conversations tool enabled...

PT-2026-81116

Name of the Vulnerable Software and Affected Versions Sakai versions 23.0 through 23.4 Sakai versions 25.0 through 25.2 Description The Sakai Conversations tool allows authenticated users to inject arbitrary HTML and JavaScript into topic and post messages. This occurs because the service layer...