VULNpocalypse
HighVulnerabilityPatch available

SHIRASAGI: JVN discloses XSS and OS command injection flaws, fixed in v1.21.1

JVN discloses cross-site scripting and OS command injection flaws in SHIRASAGI up to v1.21.0; administrators should update to SHIRASAGI v1.21.1.

Published
Fixed in
SHIRASAGI v1.21.1
Exploitation
No, exploitation is not confirmed: the JVN advisory does not report exploitation in the wild

What happened

JVN, the vulnerability portal run by JPCERT/CC and IPA, discloses two vulnerabilities in SHIRASAGI, a product provided by SHIRASAGI Project, according to its advisory JVN#55454512, published on 2026-11-05 JVN.

JVN describes the following issues:

  • CVE-2026-117679: Cross-site scripting (CWE-79). JVN says arbitrary script may be executed in a user’s web browser when the user accesses a website using the affected product. JVN lists a CVSS 4.0 base score of 5.1 and a CVSS 3.0 base score of 5.4. The vectors indicate that low privileges and user interaction are required JVN.
  • CVE-2026-118869: OS command injection (CWE-78). JVN says arbitrary OS commands may be executed on the system running the product. JVN lists a CVSS 4.0 base score of 8.7 and a CVSS 3.0 base score of 8.8. The vectors indicate that low privileges are required and no user interaction is needed JVN.

JVN credits Yuto Sato of the Department of Industrial and Systems Engineering, Faculty of Science and Technology, Tokyo University of Science, with reporting the issues to IPA. JPCERT/CC coordinated with the developer JVN.

JVN does not report exploitation in the wild. Whether either flaw has been exploited is not confirmed.

Am I affected?

According to JVN, the affected versions are as follows JVN:

  • CVE-2026-117679 (XSS): SHIRASAGI v1.12.0 to v1.21.0
  • CVE-2026-118869 (OS command injection): SHIRASAGI v1.19.0 to v1.21.0

If you run any version from v1.12.0 to v1.21.0, you are affected by at least one of these issues. JVN does not describe which specific features or components are involved, so that detail is not confirmed.

What to do now

  1. Check which SHIRASAGI version you are running.
  2. Update to SHIRASAGI v1.21.1. JVN says the developer released this version to address both vulnerabilities JVN.
  3. Prioritise instances on v1.19.0 to v1.21.0. These versions are also affected by the OS command injection flaw, which has the higher score JVN.
  4. Review the developer’s Japanese-language notice linked from the JVN advisory for further details JVN.

Sources