CVE-2026-90583: kagisearch smallweb vulnerability

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The patch is named 00b68144e583f20a6b67e29cf01bc07f57979ffb. It is recommended to apply a patch to fix this issue. Exploitability requires a raw HTTP request carrying unencoded double-quote characters in the query string - Werkzeug’s request.query_string returns the raw request-target, and ordinary browsers percent-encode “ as %22, so the payload only lands via netcat/curl-style raw sockets.

Description quoted from the CVE record (assigned by VulDB, published 2026-09-13).

Weakness: Cross Site Scripting; Code Injection

How it can be exploited

Exploitable over the network with low attack complexity with no special attack requirements needing no privileges and a user must take an action. Impact: confidentiality none, integrity low, availability none. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X

CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: no. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Exploit Observer found 5 code repositories naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 8 references on Exploit Observer

Live scores

EPSS: 0.005
low predicted chance of attack
VEDAS: 0.985
strong exploit evidence
On CISA KEV: Not listed
Detection rule: Nuclei · Suricata

Who is affected

Product	Affected	Not affected
kagisearch smallweb	version 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf	Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Vendor guidance:

https://github.com/kagisearch/smallweb/commit/00b68144e583f20a6b67e29cf01bc07f57979ffb (patch)

How to detect it

Nuclei template (active check)

Smallweb - Cross-Site Scripting
Smallweb (kagisearch) renders the raw request query string into the `action` attribute of the like/flag forms on the index page using Jinja’s `|safe` filter (`action="#"`), so an unauthenticated attacker who sends a query string containing unencoded double-quote and angle-bracket characters can break out of the attribute and inject arbitrary HTML/JavaScript. Werkzeug returns the raw request-target, so the payload must be delivered over a raw HTTP socket.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /?vedasINJ"><svg>); it decides using status, word matchers. Severity in the template: medium. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash

nuclei -u https://your-host -t CVE-2026-90583.yaml

Show the template (49 lines)

yaml

id: CVE-2026-90583

info:
  name: "Smallweb - Cross-Site Scripting"
  author: vedas-arpsyndicate
  severity: medium
  description: |
    Smallweb (kagisearch) renders the raw request query string into the `action` attribute of
    the like/flag forms on the index page using Jinja's `|safe` filter
    (`action="...like?{{ qs|safe }}"`), so an unauthenticated attacker who sends a query string
    containing unencoded double-quote and angle-bracket characters can break out of the
    attribute and inject arbitrary HTML/JavaScript. Werkzeug returns the raw request-target, so
    the payload must be delivered over a raw HTTP socket.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-90583&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=smallweb&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    cvss-score: 5.3
    cve-id: CVE-2026-90583
    cwe-id: CWE-79
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2026,smallweb,xss

http:
  - raw:
      - |
        GET /?vedasINJ"><svg> HTTP/1.1
        Host: {{Hostname}}

    unsafe: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'vedasINJ"><svg>'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

CVE-2026-90583.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-90583 Smallweb - Cross-Site Scripting via query string reflection. Add them to your Suricata rule set and reload.

Show the rules

suricata

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"VEDAS CVE-2026-90583 Smallweb - Cross-Site Scripting via query string reflection"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"<svg"; nocase; fast_pattern; pcre:"/\?[^ ]*\x22\x3e\x3csvg/i"; classtype:web-application-attack; reference:cve,CVE-2026-90583; reference:url,https://www.exploit.observer/?keyword=CVE-2026-90583&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=smallweb&match=exact; sid:1075002; rev:1;)

CVE-2026-90583.rules on GitHub

References

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.