{"id":"CVE-2024-26140","aliases":["EUVD-2024-0562","GHSA-7rw2-3hhp-rc46"],"status":"published","title":"com.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement Browser","description":"com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00447,"percentile":0.39358,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-02-20T21:47:08Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"Maven","package":"com.yetanalytics:lrs","fixed_in":["1.2.17"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.yetanalytics:lrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.17"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.yetanalytics:lrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.17"}]}]}],"products":[{"vendor":"yetanalytics","product":"lrs"},{"vendor":"yetanalytics","product":"sql_lrs"}],"references":[{"url":"https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://clojars.org/com.yetanalytics/lrs/versions/1.2.17","tags":["x_refsource_MISC","x_transferred","Product","Release Notes","web"]},{"url":"https://github.com/yetanalytics/lrs/releases/tag/v1.2.17","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26140","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7rw2-3hhp-rc46"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26140.json","tags":["advisory"]},{"url":"https://github.com/yetanalytics/lrs","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-26140","title":"com.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement Browser","description":"com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.","status":"published","published":"2024-02-20T21:47:08.027Z","modified":"2024-08-01T23:59:32.684Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:59.512321Z"}],"euvd":[{"id":"EUVD-2024-0562","description":"com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.","status":"published","published":"2024-02-20T21:47:08Z","modified":"2024-08-01T23:59:32Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T03:50:27.742015Z"}],"ghsa":[{"id":"GHSA-7rw2-3hhp-rc46","title":"Cross-site Scripting Vulnerability in Statement Browser","description":"### Impact\nA maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser.\n\n### Patches\nThe problem is patched in version 1.2.17 of the LRS library and [version 0.7.5 of SQL LRS](https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5).\n\n### Workarounds\nNo workarounds exist, we recommend upgrading to version 1.2.17 of the library or version 0.7.5 of SQL LRS immediately.\n\n### References\n* [LRS Tag](https://github.com/yetanalytics/lrs/releases/tag/v1.2.17)\n* [LRS lib on Clojars](https://clojars.org/com.yetanalytics/lrs/versions/1.2.17)\n* [SQL LRS 0.7.5 Release](https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5)\n","status":"published","published":"2024-02-21T00:24:56Z","modified":"2026-03-20T05:03:17Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:38.524712Z"}],"nvd":[{"id":"CVE-2024-26140","description":"com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.","status":"published","published":"2024-02-20T22:15:08.95Z","modified":"2026-06-17T07:17:10.947Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:37.655131Z"}],"osv":[{"id":"CVE-2024-26140","title":"com.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement Browser","description":"com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.","status":"published","published":"2024-02-20T21:47:08.027Z","modified":"2026-10-28T02:31:13.127312465Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:39.244433Z"},{"id":"GHSA-7rw2-3hhp-rc46","title":"Cross-site Scripting Vulnerability in Statement Browser","description":"### Impact\nA maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser.\n\n### Patches\nThe problem is patched in version 1.2.17 of the LRS library and [version 0.7.5 of SQL LRS](https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5).\n\n### Workarounds\nNo workarounds exist, we recommend upgrading to version 1.2.17 of the library or version 0.7.5 of SQL LRS immediately.\n\n### References\n* [LRS Tag](https://github.com/yetanalytics/lrs/releases/tag/v1.2.17)\n* [LRS lib on Clojars](https://clojars.org/com.yetanalytics/lrs/versions/1.2.17)\n* [SQL LRS 0.7.5 Release](https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5)\n","status":"published","published":"2024-02-21T00:24:56Z","modified":"2026-09-10T03:50:05.430847348Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:41.349637Z"}]}}