[ CVE-2026-96535 · Published 13 Oct 2026 ]
Vulnerability in YouMind web application
CVSS 5.1
EPSS <1%No fix listed yet
[ Description ]Official description
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN’s domain.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.