CVE-2026-40479

MEDIUM 5.4

Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Kimai is an open-source time tracking application. In versions 1.16.3 through 2.52.0, the escapeForHtml() function in KimaiEscape.js does not escape double quote or single quote characters. When a user's profile alias is inserted into an HTML attribute context via the team member form prototype and rendered through innerHTML, this incomplete escaping allows HTML attribute injection. An authenticated user with ROLE_USER privileges can store a malicious alias that executes JavaScript in the browser of any administrator viewing the team form, resulting in stored XSS with privilege escalation. This issue has been fixed in version 2.53.0.

CWE	CWE-79
Vendor	kimai
Product	kimai
Published	Apr 17, 2026

Stay Ahead of the Next One

Get instant alerts for kimai kimai

Be the first to know when new medium vulnerabilities affecting kimai kimai are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

kimai / kimai

>= 1.16.3, < 2.53.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/kimai/kimai/security/advisories/GHSA-g82g-m9vx-vhjg github.com: https://github.com/kimai/kimai/releases/tag/2.53.0