CVE-2026-61696

Name of the Vulnerable Software and Affected Versions Forem versions prior to commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c

Description An unauthenticated attacker can submit a malicious value through the feedback message[message] parameter via the public FeedbackMessagesController. When an offender id is present, this value is stored without sanitization and rendered using the raw(feedback message.message) function in the app/views/admin/feedback messages/ feedback message.html.erb file. This allows the execution of arbitrary JavaScript in an administrator's browser, potentially exposing sensitive in-page data, abuse CSRF (Cross-Site Request Forgery) tokens—tokens used to prevent unauthorized commands from being transmitted from a user the web application trusts—or performing administrative actions within the victim's session.

Recommendations Update to the version containing commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c.