CVE-2026-24037

MEDIUM

Horilla 1.4.0 - Stored Cross-Site Scripting via Incomplete Regex Filter Bypass

Title source: llm

Description

Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the has_xss() function attempts to block XSS by matching input against a set of regex patterns. However, the regexes are incomplete and context-agnostic, making them easy to bypass. Attackers are able to redirect users to malicious domains, run external JavaScript, and steal CSRF tokens that can be used to craft CSRF attacks against admins. This issue has been fixed in version 1.5.0.

References (2)

Core 2

Core References

Exploit, Vendor Advisory x_refsource_confirm

https://github.com/horilla-opensource/horilla/security/advisories/GHSA-rqw5-fjm4-rgvm

Release Notes x_refsource_misc

https://github.com/horilla-opensource/horilla/releases/tag/1.5.0

Scores

CVSS v3 4.8

EPSS 0.0023

EPSS Percentile 13.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

horilla/horilla 1.4.0

Published Jan 22, 2026

Tracked Since Feb 18, 2026