{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22867", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-12T16:20:16.746Z", "datePublished": "2026-01-15T16:31:34.397Z", "dateUpdated": "2026-01-15T16:46:57.161Z"}, "containers": {"cna": {"title": "LaSuite Doc affected by Stored XSS via Interlinking Block", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/suitenumerique/docs/security/advisories/GHSA-4rwv-ghwh-9rv6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/suitenumerique/docs/security/advisories/GHSA-4rwv-ghwh-9rv6"}, {"name": "https://github.com/suitenumerique/docs/commit/e807237dbedbc189230296b81c3aeccc1c04fa77", "tags": ["x_refsource_MISC"], "url": "https://github.com/suitenumerique/docs/commit/e807237dbedbc189230296b81c3aeccc1c04fa77"}, {"name": "https://github.com/suitenumerique/docs/releases/tag/v4.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/suitenumerique/docs/releases/tag/v4.4.0"}], "affected": [{"vendor": "suitenumerique", "product": "docs", "versions": [{"version": ">= 3.8.0, < 4.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-15T16:31:34.397Z"}, "descriptions": [{"lang": "en", "value": "LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0."}], "source": {"advisory": "GHSA-4rwv-ghwh-9rv6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-15T16:46:46.550304Z", "id": "CVE-2026-22867", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T16:46:57.161Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22867", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-15T16:46:46.550304Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T16:46:53.561Z"}}], "cna": {"title": "LaSuite Doc affected by Stored XSS via Interlinking Block", "source": {"advisory": "GHSA-4rwv-ghwh-9rv6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "suitenumerique", "product": "docs", "versions": [{"status": "affected", "version": ">= 3.8.0, < 4.4.0"}]}], "references": [{"url": "https://github.com/suitenumerique/docs/security/advisories/GHSA-4rwv-ghwh-9rv6", "name": "https://github.com/suitenumerique/docs/security/advisories/GHSA-4rwv-ghwh-9rv6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/suitenumerique/docs/commit/e807237dbedbc189230296b81c3aeccc1c04fa77", "name": "https://github.com/suitenumerique/docs/commit/e807237dbedbc189230296b81c3aeccc1c04fa77", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/suitenumerique/docs/releases/tag/v4.4.0", "name": "https://github.com/suitenumerique/docs/releases/tag/v4.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-15T16:31:34.397Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22867", "state": "PUBLISHED", "dateUpdated": "2026-01-15T16:46:57.161Z", "dateReserved": "2026-01-12T16:20:16.746Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-15T16:31:34.397Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lasuite:docs:*:*:*:*:*:*:*:*", "matchCriteriaId": "256A0A8A-1C97-4FBF-B3D8-0A0B0111B22B", "versionEndExcluding": "4.3.0", "versionStartIncluding": "3.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0."}], "id": "CVE-2026-22867", "lastModified": "2026-03-12T17:29:40.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-01-15T17:16:07.883", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/suitenumerique/docs/commit/e807237dbedbc189230296b81c3aeccc1c04fa77"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/suitenumerique/docs/releases/tag/v4.4.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/suitenumerique/docs/security/advisories/GHSA-4rwv-ghwh-9rv6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:06:10.464687+00:00", "value": {"mitigation_remediation": ["Upgrade LaSuite Docs to version 4.4.0 or newer to remove the input validation flaw.", "Identify and remove any existing javascript: links from shared documents, or replace them with safe URLs.", "Restrict editing permissions on documents to trusted users, or disable the interlinking feature until a patch is applied."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting leading to remote code execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the LaSuite Docs product from the suitenumerique vendor, specifically versions 3.8.0 through 4.3.0. Support for this issue was added in release 4.4.0, which removes the input validation flaw.", "description_and_impact": "A stored Cross\u2011Site Scripting flaw exists in the Interlinking feature of LaSuite Docs. When a collaborator with edit rights creates a link to another document, the link URL is not validated, allowing injection of a malicious javascript: URL. When other users click the link, the browser executes the embedded script, which can run arbitrary code in the context of the victim\u2019s session.", "risk_and_exploitability": "The CVSS score of 8.7 classifies this issue as high severity. Although the EPSS score is currently below 1\u202f%, indicating a low likelihood of exploitation at present, the vulnerability remains significant because it requires only editing privileges that many users possess. The problem is not listed in the CISA KEV catalog, so no widespread exploitation has been reported, but the risk of insider or compromised user attacks exists."}}}}, "created": "2026-01-16T13:43:53.323229+00:00", "updated": "2026-04-18T06:15:15.866121+00:00", "vendors": ["suitenumerique", "suitenumerique$PRODUCT$docs"]}