EUVD-2026-42780
GHSA-4qw7-r7cw-fwf5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin credentials required (PR:H), victim must view content (UI:R), XSS crosses into victim browser session (S:C) with low confidentiality and integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in MyEMS up to 6.4.0. The affected element is the function on_post of the file myems-api/core/svg.py of the component Admin Backend. The manipulation of the argument new_values['data'] results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 6.5.0 is sufficient to fix this issue. The patch is identified as 4a97edfbd786c779d0322054833b21ddf54d5b06. It is suggested to upgrade the affected component. The issue report remains open even though there is an official fix for it.
AnalysisAI
Stored cross-site scripting in MyEMS up to 6.4.0 allows a high-privileged attacker to inject malicious script via the new_values['data'] argument in the on_post function of myems-api/core/svg.py within the Admin Backend, which then executes in a victim administrator's browser upon viewing the affected SVG content. The CVSS 4.0 score of 1.9 reflects the limited real-world impact: exploitation requires existing administrative access and victim interaction, constraining this to a privilege-abuse scenario rather than an external intrusion vector. A public proof-of-concept exists via GitHub issue #412, and a vendor-released patch is available in version 6.5.0.
Technical ContextAI
MyEMS is an open-source energy management system (EMS) built on a Python-based REST API backend. The vulnerability resides in the on_post method of myems-api/core/svg.py, which handles SVG data submitted through the Admin Backend interface. SVG is an XML-based vector format that natively supports embedded JavaScript and event handlers; insufficient sanitization of user-supplied SVG content (the new_values['data'] parameter) before storage or rendering constitutes a classic CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) flaw. The affected CPE is cpe:2.3:a:n/a:myems:*:*:*:*:*:*:*:*, covering all MyEMS releases through 6.4.0. Because SVG payloads are interpreted by the browser's XML/HTML renderer, malicious content stored via this endpoint can execute arbitrary JavaScript in the context of any administrator who subsequently views the injected content.
RemediationAI
Upgrade MyEMS to version 6.5.0, which contains the official fix applied in commit 4a97edfbd786c779d0322054833b21ddf54d5b06. The release is available at https://github.com/MyEMS/myems/releases/tag/v6.5.0 and the specific patch diff can be reviewed at https://github.com/MyEMS/myems/commit/4a97edfbd786c779d0322054833b21ddf54d5b06. If an immediate upgrade is not possible, restrict access to the Admin Backend to a minimal set of trusted administrators using network-layer controls (firewall rules or VPN enforcement), reducing the pool of accounts that could be abused to inject payloads. Additionally, enforce Content Security Policy (CSP) headers on the admin interface to limit the impact of any injected scripts by blocking inline script execution - note that this is a compensating control, not a fix, and may break legitimate admin UI functionality if not carefully tuned. The GitHub issue (#412) remains open per the reporter despite the vendor fix, so operators should verify patch application by confirming the running version is 6.5.0 or later.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today