9.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27614

CVE-2026-27614: Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.13, an unauthenticated attacker who can submit events to a Bugsink project can store arbitrary JavaScript in an event. The payload executes only if a user explicitly views the affected Stacktrace in the web UI. When Pygments returns more lines than it was given (a known upstream quirk that triggers with Ruby heredoc-style input), _pygmentize_lines() in theme/templatetags/issues.py:75-77 falls back to returning the raw input lines. mark_safe() at line 111-113 is then applied unconditionally - including to those unsanitized raw lines. Since DSN endpoints are public by Sentry protocol, no account is needed to inject. The payload sits in the database until an admin looks at the event. Successful exploitation requires that the attacker to be able to submit events to the project (i.e. knows the DSN or can access a client that uses it), the Bugsink ingest endpoint is reachable to the attacker, and an administrator explicitly views the crafted event in the UI. Under those conditions, the attacker can execute JavaScript in the administrator’s browser and act with that user’s privileges within Bugsink. Version 2.0.13 fixes the vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27614

CVE-2026-27614:

9.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
bugsink	pip	<= 2.0.12	2.0.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the stacktrace rendering component of Bugsink. The root cause lies in the _pygmentize_lines function within theme/templatetags/issues.py. When the Pygments syntax highlighting library encounters an input it cannot process correctly (a known issue with certain Ruby code structures), it returns a different number of lines than it received. The _pygmentize_lines function detects this mismatch and, in the vulnerable version, falls back to returning the original, unescaped lines of code directly.

The vulnerability is triggered because the output of _pygmentize_lines is later unconditionally trusted and marked as safe for rendering in the HTML template using Django's mark_safe function. An attacker can craft a Sentry event with a malicious payload in the stacktrace. When a user views this event in the Bugsink UI, the vulnerable fallback logic is triggered, the malicious payload is returned without escaping, and mark_safe allows it to be rendered as active content in the browser, leading to XSS. The provided patch addresses the vulnerability by applying the escape() function to each line in the fallback case, ensuring that any potentially malicious characters are properly neutralized before being returned.

Vulnerable functions

_pygmentize_lines

theme/templatetags/issues.py

The function `_pygmentize_lines` is vulnerable to a stored XSS. When the Pygments library fails to process a code snippet, this function falls back to returning the raw, unescaped input lines. A calling function then unconditionally marks this output as safe for rendering, allowing an attacker to inject malicious HTML and JavaScript.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.