CVE-2026-40479: Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget

April 15, 2026 (updated April 27, 2026)

The client-side escapeForHtml() function in KimaiEscape.js, introduced in commit 89bfa82c (#2959) to fix a JavaScript XSS vulnerability, only escapes <, >, and & but does not escape " (double quote) or ' (single quote). When user-controlled data (profile alias) is placed in an HTML attribute context (title="__DISPLAY__") via the team member form prototype and rendered through innerHTML, the missing quote escaping allows HTML attribute injection, resulting in Stored XSS.

References

github.com/advisories/GHSA-g82g-m9vx-vhjg
github.com/kimai/kimai
github.com/kimai/kimai/pull/2959
github.com/kimai/kimai/releases/tag/2.53.0
github.com/kimai/kimai/security/advisories/GHSA-g82g-m9vx-vhjg
nvd.nist.gov/vuln/detail/CVE-2026-40479

Code Behaviors & Features

Detect and mitigate CVE-2026-40479 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →