CVE-2026-1493: XSS in LEX Baza Dokumentów v1.3.4

An attacker can exploit this XSS vulnerability to execute arbitrary JavaScript code in the context of the victim's browser. This can be used to steal cookies, redirect users to malicious websites, deface the application, or perform other malicious actions. While the vendor considered the impact minimal due to the requirement of setting a cookie, the ability to execute JavaScript remains a significant security risk. The potential for a more severe attack exists if an attacker can successfully set the vulnerable cookie, allowing them to compromise user accounts and potentially gain access to sensitive data stored within the application.

1. Veröffentlicht2026-04-30
2. EPSS aktualisiert2026-05-07

The primary mitigation is to upgrade LEX Baza Dokumentów to version 1.3.4 or later. Until the upgrade is possible, implement strict input validation and output encoding on the "em" cookie parameter. Consider using a Content Security Policy (CSP) to restrict the sources from which JavaScript can be executed. Regularly scan the application for XSS vulnerabilities using automated tools. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into the "em" cookie parameter and verifying that it is not executed.