CVE-2026-54049

Name of the Vulnerable Software and Affected Versions Sakai versions 23.0 through 23.4 Sakai versions 25.0 through 25.2

Description The Sakai Conversations tool allows authenticated users to inject arbitrary HTML and JavaScript into topic and post messages. This occurs because the service layer ConversationsServiceImpl stores the message field directly to the database without HTML sanitization. On the frontend, the SakaiTopic.js, SakaiPost.js, and SakaiComment.js components render this content using the unsafeHTML() directive, leading to stored cross-site scripting (XSS). This issue affects the following API endpoints:

The vulnerable variable is message. This flaw allows an attacker to perform actions on behalf of other users or exfiltrate sensitive data, such as gradebook information and course content.

Recommendations Update Sakai versions 23.0 through 23.4 to version 23.5. Update Sakai versions 25.0 through 25.2 to version 25.3. As a temporary mitigation, restrict access to the Conversations tool for untrusted users.