A release reintroduced reflected cross-site scripting on search
- Affected asset
- /search on app.example.com.au, release 2026.9.1
- Rating
- Moderate Possible 3 × Medium 3 = 9
Description
Drift detection flagged a reflected cross-site scripting issue on the search page that appeared in the scan following release 2026.9.1. The parameter was correctly encoded in the previous release; a change to the search results template removed the encoding. A consultant confirmed the finding and traced it to the release.
Evidence
GET /search?q=<script>alert(document.domain)</script>
-> reflected unencoded in results heading (rel 2026.9.1)
diff vs previous scan (rel 2026.8.4): parameter 'q'
was HTML-encoded; encoding absent after template change
The scan after the release reflected the input unencoded, where the previous release had encoded it correctly.
Impact
A fix that was in place regressed in a routine release and would have shipped unnoticed until the next manual test, potentially months away. Reflected cross-site scripting on a high-traffic page can be used to steal sessions or drive users to a malicious action. Catching it in the scan after the release closes the window to days.
Remediation
Restore output encoding in the search results template, and add a regression test that asserts the parameter is encoded so the fix cannot silently disappear again. Review the template change for other fields that lost encoding in the same release.