BeeHome MyBeeHome CVE-2026-37468

Exploitation requires the attacker to inject script via two specific application features named in the advisory: the Profile editing functionality and the chat messaging component of BeeHome MyBeeHome (versions before 2025-11-01). Successful execution is LIMITED by the UI:R requirement - a victim user must view the attacker-controlled profile or chat content for the payload to run; there is no server compromise. Storing a payload via profile editing or chat typically presupposes the attacker can reach and use those features (an application account), though the input's CVSS vector marks PR:N and the description does not explicitly state an authentication requirement, so the exact privilege needed to post content is not confirmed from available data. Impact is confined to the victim's browser session (confidentiality and integrity, Low), with no availability impact.

This is a reflected/stored Cross-Site Scripting flaw (CWE-79) scored CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - network-reachable, low complexity, but requiring victim user interaction (UI:R) and yielding only limited confidentiality and integrity impact within the browser context (the scope change S:C reflects that injected script executes in another user's session rather than against the server). The real-world signals point to low urgency: EPSS is 0.21% (11th percentile), the vulnerability is NOT in CISA KEV, and the exploitation status is that a public PoC reference exists; it is not verified as working exploit code. The vuln.today priority label is 'this_month', consistent with a Medium-severity issue rather than an emergency. Note a key conflict in the input: the description says the attacker can 'execute arbitrary code' and the Tags include 'RCE', but the CWE (CWE-79) and CVSS impact (C:L/I:L/A:N, no privilege escalation, scope change) describe client-side script execution in a victim's browser, NOT server-side remote code execution - the 'RCE' framing overstates the impact and should be read as XSS. Affected product/version data is weak: CPE and affected-version fields are 'n/a', so only the vendor-supplied cutoff 'before 2025-11-01' is available.

An attacker with access to the MyBeeHome application injects a malicious script payload into the profile-editing fields or the chat messaging component; when a victim user (or administrator) views the attacker's profile or the chat thread, the script executes in the victim's browser session. This can be used to steal session tokens, perform actions as the victim, or deface the UI. A public PoC reference exists (a GitHub repository named 'mybeehome-stored-xss-2025'); it is not verified as working exploit code, and the CVSS UI:R metric confirms the attack only succeeds once a victim interacts with the malicious content.