What is the CVSS score of CVE-2026-34229?

CVE-2026-34229 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Emlog CVE-2026-34229

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-03 GitHub_M

XSS Emlog

6.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 03, 2026 - 23:15 vuln.today

CVE Published

Apr 03, 2026 - 22:31 nvd

MEDIUM 6.1

DescriptionCVE.org

Emlog is an open source website building system. Prior to version 2.6.8, there is a stored cross-site scripting (XSS) vulnerability in emlog comment module via URI scheme validation bypass. This issue has been patched in version 2.6.8.

AnalysisAI

Stored cross-site scripting (XSS) in Emlog's comment module allows unauthenticated remote attackers to inject malicious scripts via URI scheme validation bypass, affecting all versions prior to 2.6.8. The vulnerability requires user interaction (clicking a malicious link) and can result in session hijacking, credential theft, or malware distribution to website visitors. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

Emlog is an open-source website building platform that processes user-submitted comments. The vulnerability exists in the comment module's URI/URL validation logic, which fails to properly sanitize or escape URIs before storing them in the database. This allows attackers to inject JavaScript payloads disguised as legitimate URIs (e.g., 'javascript:alert(1)' or data URIs containing encoded scripts). When stored comments are rendered in the browser without proper output encoding, the injected script executes in the context of other users' browsers. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the root cause is insufficient input validation and output encoding in the comment rendering pipeline.

RemediationAI

Vendor-released patch: Upgrade Emlog to version 2.6.8 or later immediately. This patch fixes the URI scheme validation bypass in the comment module. Apply the patch by pulling the latest release from the official Emlog GitHub repository (https://github.com/emlog/emlog) or updating via any official package manager if available. For sites unable to upgrade immediately, implement Web Application Firewall (WAF) rules to block comments containing 'javascript:', 'data:', or 'vbscript:' schemes, and ensure all user-generated content in comments is HTML-escaped before rendering. Review existing comments for malicious payloads and consider resetting comment approval workflows if XSS injection occurred historically. The upstream fix (commit a12ab1b1a273fe634abab32fd28274c18bd57f07) is available in the referenced security advisory at https://github.com/emlog/emlog/security/advisories/GHSA-74gp-xh6w-hqw6.