Cross-Site Scripting in the YouMind web application
YouMind web application.
INCIBE has coordinated the publication of a medium severity vulnerability affecting the YouMind web application, an AI-powered creative workspace and study environment. The vulnerability was discovered by Miguel Jiménez Cámara.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type:
- CVE-2026-96535: CVSS v4.0: 5.1 | CVSS AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | CWE-79
No solution has been reported as yet.
CVE-2026-96535: Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN’s domain.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-96535 | Media | No | YOUMIND |
