Low
Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts
Type: advisorySources: OSV
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-55876
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 00:50 UTC · Revision 1
Source evidence
Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts
core-osv · Original sourcePublished 15 Oct 2026, 17:23 UTC
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.
osv:CVE-2026-55876
Complete source record
{
"id": "7647c9484af41e05cb48f4ee93b4f3a06a006d3387cb3962fa7d0c32811c52ed",
"url": "https://osv.dev/vulnerability/CVE-2026-55876",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts",
"summary": "Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.",
"evidence": "osv:CVE-2026-55876",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-55876",
"aliases": [
"CVE-2026-55876",
"GHSA-7r65-76fw-ch5c"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/heliumedu/platform",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "f0de5c985c701942758b805a3d11dfb008a6af88"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.2.60"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "f0de5c985c701942758b805a3d11dfb008a6af88"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.2.60"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"2.2.59",
"2.2.58",
"2.2.57",
"2.2.56",
"2.2.55",
"2.2.54",
"2.2.53",
"2.2.52",
"2.2.51",
"2.2.50",
"2.2.49",
"2.2.48",
"2.2.47",
"2.2.46",
"2.2.45",
"2.2.44",
"2.2.43",
"2.2.42",
"2.2.41",
"2.2.40",
"2.2.39",
"2.2.38",
"2.2.37",
"2.2.36",
"2.2.35",
"2.2.34",
"2.2.33",
"2.2.32",
"2.2.31",
"2.2.30",
"2.2.29",
"2.2.28",
"2.2.27",
"2.2.26",
"2.2.25",
"2.2.23",
"2.2.22",
"2.2.21",
"2.2.20",
"2.2.19",
"2.2.18",
"2.2.17",
"2.2.16",
"2.2.15",
"2.2.13",
"2.2.12",
"2.2.11",
"2.2.10",
"backup/legacy-shutdown-pre-develop-rebase",
"2.2.9",
"2.2.8",
"2.2.7",
"2.2.6",
"backup/api-docs-cleanup-pre-rebase",
"backup/legacy-shutdown-pre-rebase",
"2.2.5",
"2.2.4",
"2.2.3",
"2.2.2",
"2.2.1",
"2.2.0",
"2.1.243",
"2.1.242",
"2.1.241",
"2.1.240",
"2.1.239",
"2.1.238",
"2.1.237",
"2.1.236",
"2.1.235",
"2.1.234",
"2.1.233",
"2.1.232",
"2.1.231",
"2.1.230",
"2.1.229",
"2.1.228",
"2.1.227",
"2.1.226",
"2.1.225",
"2.1.224",
"2.1.223",
"2.1.222",
"2.1.221",
"2.1.219",
"2.1.218",
"2.1.217",
"2.1.216",
"2.1.215",
"2.1.214",
"2.1.213",
"2.1.212",
"2.1.211",
"2.1.210",
"2.1.209",
"2.1.208",
"2.1.207",
"2.1.206",
"2.1.205",
"2.1.204",
"2.1.203",
"2.1.202",
"2.1.201",
"2.1.200",
"2.1.199",
"2.1.198",
"2.1.197",
"2.1.196",
"2.1.195",
"2.1.194",
"2.1.193",
"2.1.192",
"2.1.191",
"2.1.190",
"2.1.189",
"2.1.188",
"2.1.187",
"2.1.186",
"2.1.185",
"2.1.184",
"2.1.183",
"2.1.182",
"2.1.181",
"2.1.180",
"2.1.179",
"2.1.178",
"2.1.177",
"2.1.176",
"2.1.175",
"2.1.174",
"2.1.173",
"2.1.172",
"2.1.171",
"2.1.170",
"2.1.169",
"2.1.168",
"2.1.167",
"2.1.166",
"2.1.165",
"2.1.164",
"2.1.163",
"2.1.162",
"2.1.161",
"2.1.160",
"2.1.159",
"2.1.158",
"2.1.157",
"2.1.156",
"2.1.155",
"2.1.154",
"2.1.153",
"2.1.152",
"2.1.151",
"2.1.150",
"2.1.149",
"2.1.148",
"2.1.147",
"2.1.146",
"2.1.145",
"2.1.144",
"2.1.143",
"2.1.142",
"2.1.141",
"2.1.140",
"2.1.139",
"2.1.138",
"2.1.137",
"2.1.136",
"2.1.135",
"2.1.134",
"2.1.133",
"2.1.132",
"2.1.131",
"2.1.130",
"2.1.129",
"2.1.128",
"2.1.127",
"2.1.126",
"2.1.125",
"2.1.124",
"2.1.123",
"2.1.122",
"2.1.121",
"2.1.120",
"2.1.119",
"2.1.118",
"2.1.117",
"2.1.116",
"2.1.114",
"2.1.113",
"2.1.112",
"2.1.111",
"2.1.110",
"2.1.109",
"2.1.108",
"2.1.107",
"2.1.106",
"2.1.105",
"2.1.104",
"2.1.103",
"2.1.102",
"2.1.101",
"2.1.100",
"2.1.99",
"2.1.98",
"2.1.97",
"2.1.96",
"2.1.95",
"2.1.94",
"2.1.93",
"2.1.92",
"2.1.91",
"2.1.90",
"2.1.89",
"2.1.88",
"2.1.87",
"2.1.86",
"2.1.85",
"2.1.84",
"2.1.83",
"2.1.82",
"2.1.81",
"2.1.80",
"2.1.79",
"2.1.78",
"2.1.77",
"2.1.76",
"2.1.75",
"2.1.74",
"2.1.73",
"2.1.72",
"2.1.71",
"2.1.70",
"2.1.69",
"2.1.68",
"2.1.67",
"2.1.66",
"2.1.65",
"2.1.64",
"2.1.63",
"2.1.62",
"2.1.61",
"2.1.60",
"2.1.59",
"2.1.58",
"2.1.57",
"2.1.56",
"2.1.55",
"2.1.54",
"2.1.53",
"2.1.52",
"2.1.51",
"2.1.50",
"2.1.49",
"2.1.48",
"2.1.47",
"2.1.46",
"2.1.45",
"2.1.44",
"2.1.43",
"2.1.42",
"2.1.41",
"2.1.40",
"2.1.39",
"2.1.38",
"2.1.37",
"2.1.36",
"2.1.35",
"2.1.34",
"2.1.33",
"2.1.32",
"2.1.31",
"2.1.30",
"2.1.29",
"2.1.28",
"2.1.27",
"2.1.26",
"2.1.25",
"2.1.24",
"2.1.22",
"2.1.21",
"2.1.20",
"2.1.19",
"2.1.18",
"2.1.17",
"2.1.16",
"2.1.15",
"2.1.14",
"2.1.13",
"2.1.12",
"2.1.11",
"2.1.10",
"2.1.9",
"2.1.8",
"2.1.7",
"2.1.6",
"2.1.5",
"2.1.4",
"2.1.3",
"2.1.2",
"2.1.1",
"2.1.0",
"2.0.5",
"2.0.3",
"2.0.2",
"2.0.1",
"2.0.0",
"1.18.14",
"1.18.13",
"1.18.12",
"1.18.11",
"1.18.10",
"1.18.9",
"1.18.8",
"1.18.7",
"1.18.4",
"1.18.3",
"1.18.2",
"1.18.1",
"1.18.0",
"1.17.90",
"1.17.89",
"1.17.88",
"1.17.87",
"1.17.86",
"1.17.85",
"1.17.84",
"1.17.83",
"1.17.82",
"1.17.81",
"1.17.80",
"1.17.79",
"1.17.78",
"1.17.76",
"1.17.75",
"1.17.74",
"1.17.73",
"1.17.70",
"1.17.69",
"1.17.68",
"1.17.67",
"1.17.66",
"1.17.65",
"1.17.64",
"1.17.63",
"1.17.62",
"1.17.61",
"1.17.60",
"1.17.59",
"1.17.58",
"1.17.57",
"1.17.56",
"1.17.55",
"1.17.54",
"1.17.53",
"1.17.52",
"1.17.51",
"1.17.50",
"1.17.49",
"1.17.47",
"1.17.46",
"1.17.45",
"1.17.44",
"1.17.43",
"1.17.42",
"1.17.41",
"1.17.40",
"1.17.39",
"1.17.38",
"1.17.37",
"1.17.36",
"1.17.35",
"1.17.34",
"1.17.33",
"1.17.32",
"1.17.31",
"1.17.30",
"1.17.29",
"1.17.28",
"1.17.27",
"1.17.26",
"1.17.25",
"1.17.24",
"1.17.23",
"1.17.22",
"1.17.21",
"1.17.20",
"1.17.19",
"1.17.18",
"1.17.17",
"1.17.16",
"1.17.14",
"1.17.12",
"1.17.11",
"1.17.10",
"1.17.9",
"1.17.8",
"1.17.7",
"1.17.6",
"1.17.5",
"1.17.3",
"1.17.2",
"1.17.1",
"1.17.0",
"1.16.24",
"1.16.23",
"1.16.22",
"1.16.21",
"1.16.20",
"1.16.18",
"1.16.17",
"1.16.16",
"1.16.15",
"1.16.14",
"1.16.13",
"1.16.12",
"1.16.10",
"1.16.9",
"1.16.8",
"1.16.7",
"1.16.6",
"1.16.5",
"1.16.4",
"1.16.3",
"1.16.2",
"1.16.1",
"1.16.0",
"1.15.25",
"1.15.24",
"1.15.23",
"1.15.22",
"1.15.21",
"1.15.20",
"1.15.19",
"1.15.18",
"1.15.17",
"1.15.16",
"1.15.15",
"1.15.14",
"1.15.13",
"1.15.12",
"1.15.11",
"1.15.10",
"1.15.9",
"1.15.8",
"1.15.7",
"1.15.6",
"1.15.5",
"1.15.4",
"1.15.3",
"1.15.2",
"1.15.1",
"1.15.0",
"1.14.7",
"1.14.6",
"1.14.5",
"1.14.4",
"1.14.3",
"1.14.2",
"1.14.1",
"1.14.0",
"1.13.31",
"1.13.30",
"1.13.29",
"1.13.28",
"1.13.27",
"1.13.26",
"1.13.25",
"1.13.24",
"1.13.23",
"1.13.22",
"1.13.21",
"1.13.20",
"1.13.19",
"1.13.18",
"1.13.17",
"1.13.16",
"1.13.15",
"1.13.14",
"1.13.13",
"1.13.12",
"1.13.11",
"1.13.10",
"1.13.9",
"1.13.8",
"1.13.7",
"1.13.6",
"1.13.5",
"1.13.4",
"1.13.3",
"1.13.2",
"1.13.1",
"1.13.0",
"1.12.41",
"1.12.40",
"1.12.39",
"1.12.38",
"1.12.36",
"1.12.35",
"1.12.34",
"1.12.33",
"1.12.32",
"1.12.31",
"1.12.30",
"1.12.29",
"1.12.28",
"1.12.27",
"1.12.26",
"1.12.25",
"1.12.24",
"1.12.23",
"1.12.22",
"1.12.21",
"1.12.20",
"1.12.19",
"1.12.18",
"1.12.17",
"1.12.16",
"1.12.15",
"1.12.14",
"1.12.13",
"1.12.12",
"1.12.11",
"1.12.10",
"1.12.9",
"1.12.8",
"1.12.7",
"1.12.6",
"1.12.5",
"1.12.4",
"1.12.3",
"1.12.2",
"1.12.1",
"1.12.0",
"1.11.62",
"1.11.61",
"1.11.60",
"1.11.59",
"1.11.58",
"1.11.57",
"1.11.56",
"1.11.55",
"1.11.54",
"1.11.53",
"1.11.52",
"1.11.51",
"1.11.50",
"1.11.49",
"1.11.48",
"1.11.47",
"1.11.46",
"1.11.45",
"1.11.44",
"1.11.43",
"1.11.42",
"1.11.41",
"1.11.40",
"1.11.39",
"1.11.38",
"1.11.37",
"1.11.36",
"1.11.35",
"1.11.34",
"1.11.33",
"1.11.32",
"1.11.31",
"1.11.30",
"1.11.29",
"1.11.28",
"1.11.27",
"1.11.26",
"1.11.25",
"1.11.24",
"1.11.23",
"1.11.22",
"1.11.21",
"1.11.20",
"1.11.19",
"1.11.18",
"1.11.17",
"1.11.16",
"1.11.15",
"1.11.14",
"1.11.13",
"1.11.12",
"1.11.11",
"1.11.10",
"1.11.9",
"1.11.8",
"1.11.7",
"1.11.5",
"1.11.4",
"1.11.3",
"1.11.2",
"1.11.1",
"1.11.0",
"1.10.35",
"1.10.34",
"1.10.33",
"1.10.32",
"1.10.31",
"1.10.30",
"1.10.29",
"1.10.28",
"1.10.27",
"1.10.26",
"1.10.25",
"1.10.24",
"1.10.23",
"1.10.22",
"1.10.21",
"1.10.20",
"1.10.19",
"1.10.18",
"1.10.17",
"1.10.16",
"1.10.15",
"1.10.14",
"1.10.13",
"1.10.12",
"1.10.11",
"1.10.10",
"1.10.9",
"1.10.8",
"1.10.7",
"1.10.6",
"1.10.5",
"1.10.4",
"1.10.3",
"1.10.2",
"1.10.1",
"1.10.0",
"1.9.5",
"1.9.4",
"1.9.3",
"1.9.1",
"1.9.0",
"1.8.4",
"1.8.3",
"1.8.2",
"1.8.1",
"1.8.0",
"1.7.34",
"1.7.33",
"1.7.32",
"1.7.31",
"1.7.30",
"1.7.28",
"1.7.27",
"1.7.26",
"1.7.25",
"1.7.24",
"1.7.23",
"1.7.22",
"1.7.21",
"1.7.20",
"1.7.19",
"1.7.18",
"1.7.16",
"1.7.15",
"1.7.14",
"1.7.13",
"1.7.12",
"1.7.11",
"1.7.10",
"1.7.9",
"1.7.8",
"1.7.7",
"1.7.6",
"1.7.5",
"1.7.4",
"1.7.3",
"1.7.2",
"1.7.1",
"1.7.0",
"1.6.5",
"1.6.4",
"1.6.3",
"1.6.2",
"1.6.1",
"1.6.0",
"1.5.3",
"1.5.2",
"1.5.1",
"1.5.0",
"1.4.58",
"1.4.57",
"1.4.56",
"1.4.55",
"1.4.54",
"1.4.53",
"1.4.52",
"1.4.51",
"1.4.50",
"1.4.49",
"1.4.48",
"1.4.47",
"1.4.46",
"1.4.45",
"1.4.44",
"1.4.43",
"1.4.42",
"1.4.41",
"1.4.40",
"1.4.39",
"1.4.38",
"1.4.37",
"1.4.36",
"1.4.35",
"1.4.34",
"1.4.33",
"1.4.32",
"1.4.31",
"1.4.30",
"1.4.29",
"1.4.28",
"1.4.27",
"1.4.26",
"1.4.25",
"1.4.24",
"1.4.23",
"1.4.22",
"1.4.21",
"1.4.20",
"1.4.19",
"1.4.18",
"1.4.17",
"1.4.16",
"1.4.15",
"1.4.14",
"1.4.13",
"1.4.12",
"1.4.11",
"1.4.10",
"1.4.9",
"1.4.8",
"1.4.7",
"1.4.6",
"1.4.5",
"1.4.4",
"1.4.3",
"1.4.2",
"1.4.1",
"1.4.0",
"1.3.8",
"1.3.7",
"1.3.6",
"1.3.5",
"1.3.4",
"1.3.3",
"1.3.2",
"1.3.1",
"1.3.0",
"1.2.1",
"1.2.0",
"1.1.1",
"1.1.0",
"1.0.2",
"1.0.1",
"1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55876.json"
}
}
],
"modified": "2026-10-28T02:30:40.924070493Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55876.json",
"https://github.com/HeliumEdu/platform/security/advisories/GHSA-7r65-76fw-ch5c",
"https://nvd.nist.gov/vuln/detail/CVE-2026-55876",
"https://github.com/HeliumEdu/platform/commit/f0de5c985c701942758b805a3d11dfb008a6af88"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55876.json"
}
},
"related_cves": [
{
"value": "CVE-2026-55876",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 508713,
"published_at": "2026-10-15T17:23:07.781+00:00"
}