CVE-2026-35403

OVERVIEW: CVE-2026-35403 is a cross-site scripting (XSS) vulnerability in LORIS (Longitudinal Online Research and Imaging System), a self-hosted web application used for neuroimaging research data and project management. The vulnerability exists in the survey_accounts module across versions 15.10 through 27.0.2 and 28.0.0, stemming from improper Content-Type headers that cause browsers to interpret JSON-encoded data as HTML, potentially enabling malicious script execution. SEVERITY: The vulnerability carries a CVSS score of 5.4 (Medium) with a network-based attack vector requiring low complexity and user interaction. Exploitation requires the attacker to possess login credentials (PR:L) and trick a user into following a malicious link containing an invalid visit label. The impact is limited to low-level confidentiality and integrity breaches affecting the user's session or data, with no availability impact. The FAUCET risk score of 41.0/100 indicates moderate concern within the broader CVE landscape. EXPLOITATION STATUS: There is no evidence of active exploitation, with an EPSS score of 0.00033 indicating this vulnerability ranks in the lowest percentile for real-world attack probability. The vulnerability is not listed on the Known Exploited Vulnerabilities catalog, and no public exploit code is known to be circulating. Community attention appears minimal. Patched versions 27.0.3 and 28.0.1 are available and should be deployed to affected self-hosted LORIS installations.