---
id: CVE-2026-90583
title: >-
  A security flaw has been discovered in kagisearch smallweb up to
  0ecb9c48edbf98dc7e934b54fbac43869e64b4cf
summary: >-
  A security flaw has been discovered in kagisearch smallweb up to
  0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function
  index of the file app/sw.py of the component Query String Rendering.
  Performing a manipulatio…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-79
  - CWE-94
vendor: kagisearch
product: smallweb
affected:
  - smallweb 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf
published: '2026-09-13'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T18:19:37.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90583'
references:
  - url: 'https://github.com/kagisearch/smallweb/'
    label: cna@vuldb.com
  - url: >-
      https://github.com/kagisearch/smallweb/commit/00b68144e583f20a6b67e29cf01bc07f57979ffb
    label: cna@vuldb.com
  - url: 'https://github.com/kagisearch/smallweb/issues/854'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-90583'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/913779'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/403168'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/403168/cti'
    label: cna@vuldb.com
  - url: 'https://github.com/kagisearch/smallweb/issues/854'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T17:58:17.238128Z'
epss: 0.00282
epssPercentile: 0.20881
ingestedAt: '2026-09-14T15:23:07.468Z'
---

## Overview

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The patch is named 00b68144e583f20a6b67e29cf01bc07f57979ffb. It is recommended to apply a patch to fix this issue. Exploitability requires a raw HTTP request carrying unencoded double-quote characters in the query string - Werkzeug's request.query_string returns the raw request-target, and ordinary browsers percent-encode " as %22, so the payload only lands via netcat/curl-style raw sockets.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.