SkillTree XSS & RCE Vulnerability

SkillTree, a micro-learning platform, had a critical security flaw in versions prior to 4.4.2.

StringHighlighter.js built HTML strings without proper encoding, and HighlightedValue.vue rendered them via v-html, leading to cross-site scripting (XSS). Additionally, the account registration endpoint accepted unsanitized input, allowing remote code execution (RCE) and cross-site request forgery (CSRF) token theft.

• Impact: XSS, RCE, CSRF
• Affected: All versions prior to 4.4.2
• Mitigation: Upgrade to version 4.4.2