CVE-2026-24037 Horilla HRM has XSS Bypass through Project Name

Medium 4.8 Published 22 Jan 2026 Updated 22 Jan 2026

Attackers can bypass XSS filters to execute scripts, redirect users, and steal CSRF tokens in the Horilla HRM system.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-24037?

CVE-2026-24037 is a medium-severity cross-site scripting vulnerability in horilla-opensource horilla, published on 22 Jan 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the has_xss() function attempts to block XSS by matching input against a set of regex patterns. However, the regexes are incomplete and context-agnostic, making them easy to bypass. Attackers are able to redirect users to malicious domains, run external JavaScript, and steal CSRF tokens that can be used to craft CSRF attacks against admins. This issue has been fixed in version 1.5.0.

Weakness: CWE-79

Which versions are affected by CVE-2026-24037?

It affects 1 product.

Products include Horilla Horilla.

How do I fix CVE-2026-24037?

No fix has been published for CVE-2026-24037 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-24037 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24037 exists.

Sources

Also known as GHSA-rqw5-fjm4-rgvm.