CVE-2026-24903 — OrcaStatLLM Researcher Stored Cross-Site Scripting (XSS) via Log Message Injection in Session Page

CVE-2026-24903

OrcaStatLLM Researcher Stored Cross-Site Scripting (XSS) via Log Message Injection in Session Page PUBLISHED

Description (CNA)

OrcaStatLLM Researcher is an LLM Based Research Paper Generator. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Log Message in the Session Page in OrcaStatLLM-Researcher that allows attackers to inject and execute arbitrary JavaScript code in victims' browsers through malicious research topic inputs.

Affected (CNA)

Vendor / product	Versions
AlgoNetLab / OrcaStatLLM-Researcher	affected <= 1

CWE

CWE-79

References

https://github.com/AlgoNetLab/OrcaStatLLM-Researcher/security/advisories/GHSA-47wv-g894-82m4

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.