v10.23 2026-07-22 WeKan ® release

This release fixes the following CRITICAL VULNERABILITIES:

• ExportBleed: stored XSS in HTML board exports through a card-title second parse (CWE-79 Cross-site Scripting; GitHub Security Advisory GHSA-8r5p-4q9j-f5jx, severity High; client/lib/exportHTML.js). A board member could store entity-encoded markup in a card title (e.g. <img src=x onerror=...>). It stays inert on the live board — Blaze escapes it and the +viewer sanitizer neutralizes handlers, keeping the entity payload as text — but the exported index.html embedded a card-click handler that read the card title/body via .textContent (which DECODES HTML entities) and then concatenated those values into content.innerHTML. That SECOND parse revived the tag and ran it when a recipient clicked the card in the export, disclosing all data in that document (including cards added AFTER the attacker’s board membership was removed).

  • Fixed by building the modal with DOM nodes and assigning the card title/body through textContent, never innerHTML, so they are inserted as inert text (commit).
  • Thanks to koyokr (report) and xet7 (fix).

• SpliceBleed follow-up: incomplete multi-character sanitization re-flagged in the filename markup strip (GitHub CodeQL code scanning alert #426, rule js/incomplete-multi-character-sanitization, CWE-116 Improper Encoding or Escaping of Output; imports/lib/fileNameDisplay.js). The SpliceBleed fix (#425) looped a CHAIN of six replaces to a fixpoint — runtime-safe, but CodeQL (a local check) could not attribute the fixpoint to the individual <[^>]*>? tag replace, so it kept flagging it (“this string may still contain <script”).

  • Fixed by restructuring to the proven-complete pattern used by client/lib/importDependencies.js stripHtml() (which cleared the sibling alert #421): remove template/PI/CDATA tokens (looped), then strip HTML/XML tags with a SINGLE replace(/<[^>]*>/g, '') looped to a fixed point, then drop any stray angle bracket so even an unclosed tag (a trailing <script) cannot survive. Behaviour is unchanged, and Blaze {{ }} still HTML-escapes every rendered filename, so this stays defence-in-depth (commit).
  • Thanks to GitHub CodeQL (code scanning alert #426) and xet7 (fix).

Thanks to above GitHub users for their contributions and translators for their translations.