What is the CVSS score of CVE-2026-50883?

CVE-2026-50883 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of wastebin are affected by CVE-2026-50883?

matze wastebin v3.4.1 contains a critical stored cross-site scripting vulnerability that allows unauthenticated users to inject malicious JavaScript affecting all users who view affected pastes.

How to fix or mitigate CVE-2026-50883?

24 hours: Identify all matze wastebin v3.4.1 deployments in your infrastructure; implement strict Content-Security-Policy headers blocking inline scripts. 7 days: Deploy WAF rules to sanitize or reject pastes containing script tags and event handlers; disable or restrict the syntax highlighting feature in /src/highlight.rs. 30 days: Establish upgrade plan for patched version when released by matze project maintainers; evaluate alternative paste services if wastebin is a critical operational dependency.

wastebin CVE-2026-50883

EUVD-2026-36781 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 mitre

GHSA-ch49-46cv-33f2

XSS N A

9.6

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

6.1 MEDIUM

Anonymous paste creation gives PR:N and AC:L over the network; victim must view the paste (UI:R); stored XSS changes scope to the browser (S:C) with limited C/I and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 15:34 vuln.today

CVSS changed

Jun 16, 2026 - 15:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts via a crafted payload.

AnalysisAI

Stored HTML/script injection in matze wastebin v3.4.1 allows remote unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who views a crafted paste, by abusing improper output encoding in the /src/highlight.rs syntax-highlighting component. A public gist appears to demonstrate the issue, but no public exploit identified at time of analysis as weaponized tooling, and EPSS exploitation probability is low at 0.18% (8th percentile).

Technical ContextAI

Wastebin is a self-hosted Rust-based pastebin service maintained by upstream developer 'matze'. The vulnerable code path is the highlight.rs module, which is responsible for rendering user-submitted snippets with syntax highlighting before emitting them as HTML. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the highlighter is failing to encode or sanitize user-controlled tokens before they are interpolated into the HTML response, so an attacker-controlled paste body is rendered as live markup rather than inert text. Because pastes are served back to any visitor of the paste URL, the flaw behaves as a stored cross-site scripting issue executing in the wastebin origin.

RemediationAI

No vendor-released patch identified at time of analysis - operators should monitor the upstream wastebin GitHub repository for a release newer than 3.4.1 that addresses the highlight.rs encoding issue and upgrade as soon as a fixed tag is published; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-50883 should be checked for an updated patch reference. As compensating controls until a fix is available, deploy a strict Content-Security-Policy response header on the wastebin host that disallows inline scripts (e.g., script-src 'self' without 'unsafe-inline'), which neutralizes injected <script> blocks at the cost of breaking any legitimate inline scripting in custom themes; restrict paste creation to authenticated or IP-allowlisted users via a reverse proxy to remove the unauthenticated attack surface, accepting the loss of anonymous public-paste functionality; and disable or replace the syntax-highlighting feature on the instance if the deployment can tolerate plain-text rendering, which eliminates the vulnerable code path entirely.