What is GHSA-cjg2-mvj3-g74m?

GHSA-cjg2-mvj3-g74m is a security advisory published by GitHub Security Advisories with High severity. LimeSurvey fails to safely encode attacker-controlled content from a crafted .lss survey file...

Which CVE IDs does GHSA-cjg2-mvj3-g74m cover?

GHSA-cjg2-mvj3-g74m covers the following CVE IDs: CVE-2026-91775. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-cjg2-mvj3-g74mHigh

LimeSurvey fails to safely encode attacker-controlled content from a crafted .lss survey file...

Vendor

GitHub Security Advisories

Published

September 23, 2026

Last Modified

September 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-91775 →

📋 Description

LimeSurvey fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-91775
https://github.com/LimeSurvey/LimeSurvey/commit/c96db8093e852eb8b1a2ebbb32478d6fb34cb651
https://fluidattacks.com/advisories/alone
https://github.com/LimeSurvey/LimeSurvey
https://github.com/advisories/GHSA-cjg2-mvj3-g74m