Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render (CVE-2026-91922)

Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render (CVE-2026-91922) | HOL Guard CVE

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps steedos/steedos-platform (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
steedos/steedos-platformgeneric	0	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for steedos/steedos-platform.
Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 15, 2026

Sources and claim methodology

Upstream source description

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials.

Quoted source text, attributed separately from HOL analysis.