CVE-2026-27469: Isso... You Have Chosen Death: Analyzing CVE-2026-27469

Isso... You Have Chosen Death: Analyzing CVE-2026-27469 Vulnerability ID: CVE-2026-27469 CVSS Score: 6.1 Published: 2026-02-24 In the world of self-hosted services, Isso has long been the darling of the static site generation crowd—a lightweight, Python-based commenting server that promised to free us from the tracking claws of Disqus. But as with all things that handle user input, the devil is in the sanitization details. CVE-2026-27469 is a classic Stored Cross-Site Scripting (XSS) vulnerability that highlights a fundamental misunderstanding of Python's standard library. By explicitly telling the HTML escaper not to escape quotes, the developers inadvertently handed attackers a key to break out of HTML attributes. Combined with a completely unprotected edit endpoint, this vulnerability turns the humble comment section into a launchpad for browser-based attacks. TL;DR A Stored XSS vulnerability in Isso allows attackers to inject malicious JavaScript via the 'website' and 'author' fiel