EUVD-2026-114739
GHSA-ggpr-cj64-vcq3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess PostyBirb Plus as app user
-
DeliveryLoad crafted submission description value
-
ExploitUnsanitized content rendered in editor
-
ExecutionScript executes in Electron renderer
-
ImpactLimited integrity impact on submission content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires crafted description markup to reach the editor through the defaultValue or overwriteDescriptionValue props, which up to version 3.1.75 were rendered without the sanitize() call that previously guarded only the paste_preprocess path; the 3.1.76 patch adds a sanitizeContent() wrapper applied to those loaded values. Limiting factors: the attacker needs an authenticated local user of the PostyBirb Plus desktop app (PR:L), the flaw requires user interaction to trigger (UI:P), and impact is limited to integrity (script execution in the renderer) with no confidentiality or availability loss. |
| Impact | This is a medium-severity stored/DOM cross-site scripting issue (CWE-79) in the PostyBirb Plus submission description editor, with a vendor CVSS 4.0 score of 5.1. The supplied vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P) shows meaningful limiting factors: PR:L requires a user of the local Electron application and UI:P requires passive user interaction, while impact is confined to integrity (VI:L) with no confidentiality or availability effect. It is NOT in CISA KEV, so this is not confirmed actively exploited; the exploitation phrasing here is driven by a PoC reference only, not active exploitation. A public PoC reference exists (a report.md attachment); it is not verified as working exploit code. EPSS is not provided in the input, so exploitation probability cannot be weighed. The vuln.today Decision label is this_month, consistent with a patchable medium-impact client-side flaw rather than an emergency. Net: a genuine but modest-priority issue - the high-CVSS-but-low-real-risk concern does not apply (score is medium), yet the local-user privilege requirement, required user interaction, and limited integrity-only impact keep real-world risk moderate. A fixed version (3.1.76) is available and upgrading is the remediation the vendor provides. |
| Exploit ScenarioDerived | An attacker crafts submission description content containing HTML/script (for example an img element with an event handler) and gets it loaded into the editor through a pre-filled or imported description value. On versions up to 3.1.75 the editor only sanitized pasted content, not the defaultValue/overwriteDescriptionValue that populate the field, so the crafted markup renders and script executes in the Electron renderer. A public PoC report reference exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 01, 2026
Cross-site scripting in the PostyBirb Plus submission description editor affects versions through 3.1.75. Crafted description markup loaded through the editor's defaultValue or overwriteDescriptionValue paths can execute in the Electron renderer, but exploitation requires an authenticated local user of the desktop app and user interaction, and impact is limited to integrity with no confidentiality or availability loss. Version 3.1.76 fixes the issue by sanitizing those loaded values; a public PoC reference exists, but it is not verified as working exploit code.
RemediationAI
Upgrade PostyBirb Plus to version 3.1.76, the vendor-released patch; the fix is identified by commit 6b11c2345ad98ae59fd5404a9f1024eb1d10c8a4 and release https://github.com/mvdicarlo/postybirb-plus/releases/tag/v3.1.76, with additional references at https://github.com/mvdicarlo/postybirb-plus/pull/506 and https://vuldb.com/vuln/429529. Updating is the vendor-recommended resolution and adds sanitizeContent() to the defaultValue and overwriteDescriptionValue paths. If upgrading immediately is not possible, avoid loading untrusted description markup into the defaultValue or overwriteDescriptionValue props as a compensating measure, recognizing that this can reduce functionality for imported or shared descriptions and is not a substitute for applying the 3.1.76 patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is CWE-79 cross-site scripting in the React/TypeScript component ui/src/views/submissions/submission-forms/form-components/DescriptionInput.tsx, part of the PostyBirb Plus Electron desktop application's submission description editor. Up to version 3.1.75, sanitize-html was applied only in the paste_preprocess path, while description values supplied through the defaultValue and overwriteDescriptionValue props were rendered without that sanitization; the value binding also used the raw defaultValue.value. The 3.1.76 patch adds a sanitizeContent() helper using sanitize-html with an allowlist for tags, attributes, schemes, and text-align styles, and applies it to initial data, overwrite values, the update path, and the rendered value. The resulting issue is a stored/DOM XSS condition in the renderer, not a server-side flaw. The CPE entry identifies the affected product family as postybirb_plus.
Know when Postybirb Plus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Requires an authenticated app user (PR:L) and user interaction (UI:R) to load crafted content; limited script-injection integrity impact (I:L), no confidentiality or availability loss.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionality of the file ui/src/views/submissions/submission-forms/form-components/DescriptionInput.tsx of the component Submission Description Editor. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.1.76 addresses this issue. The patch is identified as 6b11c2345ad98ae59fd5404a9f1024eb1d10c8a4. It is advisable to upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB