{"id":"CVE-2026-55876","summary":"Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts","details":"Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.","aliases":["GHSA-7r65-76fw-ch5c"],"modified":"2026-10-16T02:47:59.638904319Z","published":"2026-10-15T17:23:07.781Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55876.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55876.json"},{"type":"FIX","url":"https://github.com/HeliumEdu/platform/commit/f0de5c985c701942758b805a3d11dfb008a6af88"},{"type":"ADVISORY","url":"https://github.com/HeliumEdu/platform/security/advisories/GHSA-7r65-76fw-ch5c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55876"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/heliumedu/platform","events":[{"introduced":"0"},{"fixed":"f0de5c985c701942758b805a3d11dfb008a6af88"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"fixed":"2.2.60"}]}}],"versions":["2.2.59","2.2.58","2.2.57","2.2.56","2.2.55","2.2.54","2.2.53","2.2.52","2.2.51","2.2.50","2.2.49","2.2.48","2.2.47","2.2.46","2.2.45","2.2.44","2.2.43","2.2.42","2.2.41","2.2.40","2.2.39","2.2.38","2.2.37","2.2.36","2.2.35","2.2.34","2.2.33","2.2.32","2.2.31","2.2.30","2.2.29","2.2.28","2.2.27","2.2.26","2.2.25","2.2.23","2.2.22","2.2.21","2.2.20","2.2.19","2.2.18","2.2.17","2.2.16","2.2.15","2.2.13","2.2.12","2.2.11","2.2.10","backup/legacy-shutdown-pre-develop-rebase","2.2.9","2.2.8","2.2.7","2.2.6","backup/api-docs-cleanup-pre-rebase","backup/legacy-shutdown-pre-rebase","2.2.5","2.2.4","2.2.3","2.2.2","2.2.1","2.2.0","2.1.243","2.1.242","2.1.241","2.1.240","2.1.239","2.1.238","2.1.237","2.1.236","2.1.235","2.1.234","2.1.233","2.1.232","2.1.231","2.1.230","2.1.229","2.1.228","2.1.227","2.1.226","2.1.225","2.1.224","2.1.223","2.1.222","2.1.221","2.1.219","2.1.218","2.1.217","2.1.216","2.1.215","2.1.214","2.1.213","2.1.212","2.1.211","2.1.210","2.1.209","2.1.208","2.1.207","2.1.206","2.1.205","2.1.204","2.1.203","2.1.202","2.1.201","2.1.200","2.1.199","2.1.198","2.1.197","2.1.196","2.1.195","2.1.194","2.1.193","2.1.192","2.1.191","2.1.190","2.1.189","2.1.188","2.1.187","2.1.186","2.1.185","2.1.184","2.1.183","2.1.182","2.1.181","2.1.180","2.1.179","2.1.178","2.1.177","2.1.176","2.1.175","2.1.174","2.1.173","2.1.172","2.1.171","2.1.170","2.1.169","2.1.168","2.1.167","2.1.166","2.1.165","2.1.164","2.1.163","2.1.162","2.1.161","2.1.160","2.1.159","2.1.158","2.1.157","2.1.156","2.1.155","2.1.154","2.1.153","2.1.152","2.1.151","2.1.150","2.1.149","2.1.148","2.1.147","2.1.146","2.1.145","2.1.144","2.1.143","2.1.142","2.1.141","2.1.140","2.1.139","2.1.138","2.1.137","2.1.136","2.1.135","2.1.134","2.1.133","2.1.132","2.1.131","2.1.130","2.1.129","2.1.128","2.1.127","2.1.126","2.1.125","2.1.124","2.1.123","2.1.122","2.1.121","2.1.120","2.1.119","2.1.118","2.1.117","2.1.116","2.1.114","2.1.113","2.1.112","2.1.111","2.1.110","2.1.109","2.1.108","2.1.107","2.1.106","2.1.105","2.1.104","2.1.103","2.1.102","2.1.101","2.1.100","2.1.99","2.1.98","2.1.97","2.1.96","2.1.95","2.1.94","2.1.93","2.1.92","2.1.91","2.1.90","2.1.89","2.1.88","2.1.87","2.1.86","2.1.85","2.1.84","2.1.83","2.1.82","2.1.81","2.1.80","2.1.79","2.1.78","2.1.77","2.1.76","2.1.75","2.1.74","2.1.73","2.1.72","2.1.71","2.1.70","2.1.69","2.1.68","2.1.67","2.1.66","2.1.65","2.1.64","2.1.63","2.1.62","2.1.61","2.1.60","2.1.59","2.1.58","2.1.57","2.1.56","2.1.55","2.1.54","2.1.53","2.1.52","2.1.51","2.1.50","2.1.49","2.1.48","2.1.47","2.1.46","2.1.45","2.1.44","2.1.43","2.1.42","2.1.41","2.1.40","2.1.39","2.1.38","2.1.37","2.1.36","2.1.35","2.1.34","2.1.33","2.1.32","2.1.31","2.1.30","2.1.29","2.1.28","2.1.27","2.1.26","2.1.25","2.1.24","2.1.22","2.1.21","2.1.20","2.1.19","2.1.18","2.1.17","2.1.16","2.1.15","2.1.14","2.1.13","2.1.12","2.1.11","2.1.10","2.1.9","2.1.8","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2","2.1.1","2.1.0","2.0.5","2.0.3","2.0.2","2.0.1","2.0.0","1.18.14","1.18.13","1.18.12","1.18.11","1.18.10","1.18.9","1.18.8","1.18.7","1.18.4","1.18.3","1.18.2","1.18.1","1.18.0","1.17.90","1.17.89","1.17.88","1.17.87","1.17.86","1.17.85","1.17.84","1.17.83","1.17.82","1.17.81","1.17.80","1.17.79","1.17.78","1.17.76","1.17.75","1.17.74","1.17.73","1.17.70","1.17.69","1.17.68","1.17.67","1.17.66","1.17.65","1.17.64","1.17.63","1.17.62","1.17.61","1.17.60","1.17.59","1.17.58","1.17.57","1.17.56","1.17.55","1.17.54","1.17.53","1.17.52","1.17.51","1.17.50","1.17.49","1.17.47","1.17.46","1.17.45","1.17.44","1.17.43","1.17.42","1.17.41","1.17.40","1.17.39","1.17.38","1.17.37","1.17.36","1.17.35","1.17.34","1.17.33","1.17.32","1.17.31","1.17.30","1.17.29","1.17.28","1.17.27","1.17.26","1.17.25","1.17.24","1.17.23","1.17.22","1.17.21","1.17.20","1.17.19","1.17.18","1.17.17","1.17.16","1.17.14","1.17.12","1.17.11","1.17.10","1.17.9","1.17.8","1.17.7","1.17.6","1.17.5","1.17.3","1.17.2","1.17.1","1.17.0","1.16.24","1.16.23","1.16.22","1.16.21","1.16.20","1.16.18","1.16.17","1.16.16","1.16.15","1.16.14","1.16.13","1.16.12","1.16.10","1.16.9","1.16.8","1.16.7","1.16.6","1.16.5","1.16.4","1.16.3","1.16.2","1.16.1","1.16.0","1.15.25","1.15.24","1.15.23","1.15.22","1.15.21","1.15.20","1.15.19","1.15.18","1.15.17","1.15.16","1.15.15","1.15.14","1.15.13","1.15.12","1.15.11","1.15.10","1.15.9","1.15.8","1.15.7","1.15.6","1.15.5","1.15.4","1.15.3","1.15.2","1.15.1","1.15.0","1.14.7","1.14.6","1.14.5","1.14.4","1.14.3","1.14.2","1.14.1","1.14.0","1.13.31","1.13.30","1.13.29","1.13.28","1.13.27","1.13.26","1.13.25","1.13.24","1.13.23","1.13.22","1.13.21","1.13.20","1.13.19","1.13.18","1.13.17","1.13.16","1.13.15","1.13.14","1.13.13","1.13.12","1.13.11","1.13.10","1.13.9","1.13.8","1.13.7","1.13.6","1.13.5","1.13.4","1.13.3","1.13.2","1.13.1","1.13.0","1.12.41","1.12.40","1.12.39","1.12.38","1.12.36","1.12.35","1.12.34","1.12.33","1.12.32","1.12.31","1.12.30","1.12.29","1.12.28","1.12.27","1.12.26","1.12.25","1.12.24","1.12.23","1.12.22","1.12.21","1.12.20","1.12.19","1.12.18","1.12.17","1.12.16","1.12.15","1.12.14","1.12.13","1.12.12","1.12.11","1.12.10","1.12.9","1.12.8","1.12.7","1.12.6","1.12.5","1.12.4","1.12.3","1.12.2","1.12.1","1.12.0","1.11.62","1.11.61","1.11.60","1.11.59","1.11.58","1.11.57","1.11.56","1.11.55","1.11.54","1.11.53","1.11.52","1.11.51","1.11.50","1.11.49","1.11.48","1.11.47","1.11.46","1.11.45","1.11.44","1.11.43","1.11.42","1.11.41","1.11.40","1.11.39","1.11.38","1.11.37","1.11.36","1.11.35","1.11.34","1.11.33","1.11.32","1.11.31","1.11.30","1.11.29","1.11.28","1.11.27","1.11.26","1.11.25","1.11.24","1.11.23","1.11.22","1.11.21","1.11.20","1.11.19","1.11.18","1.11.17","1.11.16","1.11.15","1.11.14","1.11.13","1.11.12","1.11.11","1.11.10","1.11.9","1.11.8","1.11.7","1.11.5","1.11.4","1.11.3","1.11.2","1.11.1","1.11.0","1.10.35","1.10.34","1.10.33","1.10.32","1.10.31","1.10.30","1.10.29","1.10.28","1.10.27","1.10.26","1.10.25","1.10.24","1.10.23","1.10.22","1.10.21","1.10.20","1.10.19","1.10.18","1.10.17","1.10.16","1.10.15","1.10.14","1.10.13","1.10.12","1.10.11","1.10.10","1.10.9","1.10.8","1.10.7","1.10.6","1.10.5","1.10.4","1.10.3","1.10.2","1.10.1","1.10.0","1.9.5","1.9.4","1.9.3","1.9.1","1.9.0","1.8.4","1.8.3","1.8.2","1.8.1","1.8.0","1.7.34","1.7.33","1.7.32","1.7.31","1.7.30","1.7.28","1.7.27","1.7.26","1.7.25","1.7.24","1.7.23","1.7.22","1.7.21","1.7.20","1.7.19","1.7.18","1.7.16","1.7.15","1.7.14","1.7.13","1.7.12","1.7.11","1.7.10","1.7.9","1.7.8","1.7.7","1.7.6","1.7.5","1.7.4","1.7.3","1.7.2","1.7.1","1.7.0","1.6.5","1.6.4","1.6.3","1.6.2","1.6.1","1.6.0","1.5.3","1.5.2","1.5.1","1.5.0","1.4.58","1.4.57","1.4.56","1.4.55","1.4.54","1.4.53","1.4.52","1.4.51","1.4.50","1.4.49","1.4.48","1.4.47","1.4.46","1.4.45","1.4.44","1.4.43","1.4.42","1.4.41","1.4.40","1.4.39","1.4.38","1.4.37","1.4.36","1.4.35","1.4.34","1.4.33","1.4.32","1.4.31","1.4.30","1.4.29","1.4.28","1.4.27","1.4.26","1.4.25","1.4.24","1.4.23","1.4.22","1.4.21","1.4.20","1.4.19","1.4.18","1.4.17","1.4.16","1.4.15","1.4.14","1.4.13","1.4.12","1.4.11","1.4.10","1.4.9","1.4.8","1.4.7","1.4.6","1.4.5","1.4.4","1.4.3","1.4.2","1.4.1","1.4.0","1.3.8","1.3.7","1.3.6","1.3.5","1.3.4","1.3.3","1.3.2","1.3.1","1.3.0","1.2.1","1.2.0","1.1.1","1.1.0","1.0.2","1.0.1","1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55876.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"}]}