What is the CVSS score of CVE-2026-27937?

CVE-2026-27937 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-27937?

Yes, a patch is available for CVE-2026-27937. Update the affected software to the latest version immediately.

October CMS CVE-2026-27937

EUVD-2026-24157 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-21 GitHub_M

GHSA-jj38-h5w5-mvpf

XSS October

3.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 22, 2026 - 21:08 nvd

Patch available

Apr 21, 2026 - 18:01 EUVD

Analysis Generated

Apr 21, 2026 - 17:01 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 16:30 euvd

EUVD-2026-24157

Analysis Generated

Apr 21, 2026 - 16:30 vuln.today

CVE Published

Apr 21, 2026 - 16:17 nvd

LOW 3.1

DescriptionGitHub Advisory

October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and 4.1.16.

AnalysisAI

Reflected cross-site scripting (XSS) in October CMS backend DataTable widget allows unauthenticated remote attackers to inject arbitrary JavaScript via a query parameter, requiring user interaction to execute malicious code. The vulnerability affects versions prior to 3.7.16 and 4.1.16, with a low severity CVSS score of 3.1 reflecting the requirement for high attack complexity and user clicking a malicious link.

Technical ContextAI

The vulnerability exists in the backend DataTable widget, a server-side interface component used for data display and management. A query parameter is rendered into the HTML response without proper output encoding or sanitization, allowing an attacker to break out of the HTML context and inject script tags or event handlers. This is a classic reflected XSS (CWE-79) vulnerability where untrusted input flows directly from the HTTP request to the response. The attack vector is network-accessible, but the high attack complexity requirement (AC:H) suggests either the parameter must be crafted carefully or the vulnerable code path is not trivially exposed, such as requiring a specific browser behavior or encoding bypass.

RemediationAI

Upgrade to October CMS 3.7.16 or 4.1.16 or later, depending on the currently deployed major version. Both versions contain the fix implementing proper output encoding of query parameters in the DataTable widget. Administrators should test the upgrade in a non-production environment before deploying to production to ensure no custom extensions are broken by the fix. If immediate patching is not possible, restrict backend access to trusted networks only using web server firewall rules or reverse proxy authentication, and educate users not to click links to the backend from untrusted sources. These compensating controls reduce the attack surface by limiting who can be socially engineered into clicking a malicious link, though they do not eliminate the vulnerability itself.