CVE-2023-33969 Stored Cross site scripting in the Task External Link Functionality in Kanboard

What is CVE-2023-33969?

CVE-2023-33969 is a medium-severity cross-site scripting vulnerability in kanboard, published on 5 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Kanboard is open source project management software that focuses on the Kanban methodology. A stored Cross site scripting (XSS) allows an attacker to execute arbitrary Javascript and any user who views the task containing the malicious code will be exposed to the XSS attack. Note: The default CSP header configuration blocks this javascript attack. This issue has been addressed in version 1.2.30. Users are advised to upgrade. Users unable to upgrade should ensure that they have a restrictive CSP header config.

Weakness: CWE-79

Which versions are affected by CVE-2023-33969?

It affects 1 product.

Products include Kanboard Kanboard.

How do I fix CVE-2023-33969?

No fix has been published for CVE-2023-33969 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-33969 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-33969 exists.

Other vulnerabilities in kanboard

• CVE-2026-21881 Kanboard is Vulnerable to Reverse Proxy Authentication Bypass Critical 9.1
• CVE-2025-55010 Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events Critical 9.1
• CVE-2024-51747 Arbitrary File Read and Delete in kanboard Critical 9.1
• CVE-2024-51748 Remote code execution through language setting in kanboard Critical 9.1
• CVE-2017-12850 Business logic in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8qvf-9847-gpc9.