Diem Admin Plugin CVE-2026-112038

Exploitation requires the attacker to be authenticated with high (administrative) privileges in the Diem admin plugin (PR:H), and a victim user must interact by viewing the affected Version Check Service view that renders attacker input through the html function in dmAdminCtrl.js (UI:P). The specific feature required is the Version Check Service component of the dmAdminPlugin. Limiting factors: the high-privilege precondition means an unprivileged or anonymous remote attacker cannot trigger this directly, the required user interaction further narrows realistic abuse, and because the project uses a rolling release with no vendor fix, exposure depends on running an unpatched checkout at or near commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad.

This is a genuinely low-priority issue despite being network-exploitable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N) scores 4.8 (Medium), and the limiting metrics dominate: PR:H means the attacker must already hold high (administrative) privileges in the Diem admin interface, and UI:P means a victim must be induced to view the malicious content. The impact is confined to low integrity (VI:L) with no confidentiality or availability effect - consistent with a stored/reflected XSS in an admin-side JavaScript controller. Exploit maturity is E:P (proof-of-concept), matching the 'POC publicly available' signal: a public disclosure exists via the GitHub issue, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation. The high-privilege precondition largely makes this a self-XSS or admin-on-admin scenario rather than a path to initial compromise. No conflicting signals were found, but note the data originates solely from VulDB - there is no independent vendor advisory, and the project has reportedly not responded to the issue report.

An authenticated high-privilege user of the Diem admin interface supplies crafted input that is reflected unsanitized by the html function in dmAdminPlugin/web/js/dmAdminCtrl.js (Version Check Service), so that when an administrator views the affected view, attacker-controlled script executes in their browser session. A public proof-of-concept is referenced in the project's GitHub issue tracker (issue #455). Because high privileges and victim interaction are both required, realistic abuse is limited to a malicious/compromised admin targeting another operator.