What is the CVSS score of CVE-2026-43892?

CVE-2026-43892 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-43892?

Yes, a patch is available for CVE-2026-43892. Update the affected software to the latest version immediately.

AntSword CVE-2026-43892

EUVD-2026-29721 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 security-advisories@github.com

XSS

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via malicious server output (AV:N), no auth on the client (PR:N) but requires operator interaction (UI:R); Electron RCE yields total confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 20:09 vuln.today

Patch available

May 12, 2026 - 19:18 EUVD

CVE Published

May 12, 2026 - 18:17 nvd

HIGH 8.8

DescriptionGitHub Advisory

AntSword is a cross-platform website management toolkit. Prior to 2.1.16, incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection. This vulnerability is fixed in 2.1.16.

AnalysisAI

1-click remote code execution in AntSword before 2.1.16 lets a malicious web server or webshell endpoint execute arbitrary code on the operator's machine by injecting jquery.terminal format codes that the incomplete noxss() filter fails to sanitize. Because AntSword is an Electron-based client, cross-site scripting in the terminal renderer escalates to full RCE in the desktop application. Rated CVSS 8.8; no public exploit is identified at time of analysis, EPSS is only 0.04%, and SSVC records exploitation status as none.

Technical ContextAI

AntSword is a cross-platform, Electron/Node.js website-management (webshell) client that renders server responses inside a jquery.terminal component. The vulnerability is a CWE-79 cross-site scripting flaw: the noxss() routine intended to neutralize hostile output performs incomplete sanitization, allowing jquery.terminal format/escape codes (e.g. bracketed formatting sequences) to inject active markup. In an Electron context with Node integration, XSS in the renderer is not merely script execution in a browser sandbox but a path to arbitrary command execution on the host, converting a display-layer injection into full RCE. The EUVD entry EUVD-2026-29721 and GitHub advisory GHSA-c63g-p4cp-r45x track the same issue.

RemediationAI

Vendor-released patch: upgrade AntSword to version 2.1.16, which corrects the noxss() sanitization; this is the primary and definitive fix per the vendor advisory at https://github.com/AntSwordProject/antSword/security/advisories/GHSA-c63g-p4cp-r45x. Until upgrading, do not connect the client to untrusted, third-party, or attacker-controlled endpoints, since exploitation requires the client to render malicious server output - avoiding interaction with unknown shells removes the trigger, at the cost of the tool's normal workflow. Because the flaw executes in an Electron renderer, running the application inside a disposable/sandboxed VM limits blast radius if a hostile response is processed, with the trade-off of added operational overhead. No exact fix version other than 2.1.16 should be assumed.