CVE-2026-96535
Cross-Site Scripting in the YouMind web application
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN’s domain.
| CWE | CWE-79 |
| Vendor | youmind |
| Product | youmind web application |
| Published | Oct 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for youmind youmind web application
Be the first to know when new unknown vulnerabilities affecting youmind youmind web application are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
YouMind / YouMind web application
0 < 13/10/2026
References
Credits
Miguel Jiménez Cámara