{"schema":"threatline.record/2","record":{"id":"CVE-2026-96535","aliases":[],"summary":"Cross-Site Scripting in the YouMind web application","details":"Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN’s domain.","categories":["Unclassified"],"product":"YouMind web application","vendor":"YouMind","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96535","source_modified_at":"2026-10-16T17:18:42.653Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"YouMind web application","vendor":"YouMind","versions":[{"status":"affected","version":"0","lessThan":"13/10/2026","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96535","source_modified_at":"2026-10-16T17:18:42.653Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"YouMind web application","ecosystem":null},"version":"13/10/2026","basis":"first unaffected version stated in the CVE record"}],"cvss":5.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00234,"percentile":0.13509,"score_date":"2026-10-23"},"published_at":"2026-10-13T08:41:05.153Z","modified_at":"2026-10-16T17:18:42.653Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-96535","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T17:18:42.653Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96535","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-youmind-web-application"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-16T17:01:44.922538Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T17:18:42.653Z","content_hash":"de35a979cc71fee158d20b3157cd4239029977a691cf251e55a5da1f22f10a35"}}