Bugsink ist anfällig für Stored XSS über Pygments Fallback beim Stacktrace Rendering

Successful exploitation of CVE-2026-27614 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to a wide range of malicious activities, including session hijacking, credential theft, and defacement of the Bugsink web interface. The attacker does not need authentication to inject the payload, making the vulnerability particularly concerning. The execution is triggered when a user views the affected Stacktrace, meaning targeted users are at the highest risk. The vulnerability stems from a combination of an upstream quirk in Pygments and the unconditional application of mark_safe() to potentially unsanitized raw lines.

Organizations using Bugsink for error tracking and debugging are at risk, particularly those with public-facing DSN endpoints. Shared hosting environments where multiple users share a Bugsink instance are also at increased risk, as an attacker could potentially exploit the vulnerability through another user's event submissions. Teams relying on legacy configurations or outdated deployment practices are also more vulnerable.

• python / server:

# Check for vulnerable versions of Bugsink
import subprocess
result = subprocess.run(['pip', 'show', 'bugsink'], capture_output=True, text=True)
if 'Version: <=2.0.9' in result.stdout:
    print('Vulnerable Bugsink version detected!')

• generic web:

curl -I https://your-bugsink-instance/ | grep -i 'content-security-policy'
# Look for missing or weak CSP policies that allow inline scripts

1. 2026-02-25Disclosure

   disclosure

1. Reserviert2026-02-20
2. Veröffentlicht2026-02-25
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-27614 is to upgrade Bugsink to version 2.0.13 or later, which contains the necessary fix. If upgrading immediately is not possible, consider implementing a temporary workaround by carefully sanitizing all user-supplied input before it is processed by the pygmentizelines() function. While a WAF might offer some protection, it's unlikely to be effective against this type of XSS without specific rules tailored to the Bugsink codebase. After upgrading, confirm the fix by attempting to submit an event with a simple JavaScript payload and verifying that it does not execute when viewing the Stacktrace.