EUVD-2026-17775Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A weakness has been identified in bufanyun HotGo 1.0/2.0. Affected by this vulnerability is an unknown functionality of the file /web/src/layout/components/Header/MessageList.vue of the component editNotice Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stored cross-site scripting (XSS) in bufanyun HotGo 1.0/2.0 allows authenticated remote attackers to inject malicious scripts via the editNotice endpoint in the MessageList.vue component, affecting the application's message handling functionality. The vulnerability requires user interaction (UI:R) to execute but has publicly available exploit code and a low CVSS score (3.5) due to limited attack complexity and minimal impact scope. The vendor has not responded to early disclosure attempts.
Technical ContextAI
The vulnerability exists in a Vue.js component (MessageList.vue) within the HotGo web application framework at the /web/src/layout/components/Header/ path. The editNotice endpoint fails to properly sanitize user input before rendering it in the UI, allowing injection of arbitrary HTML/JavaScript content. This is a classic Reflected or Stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) where unsanitized data flows directly from the editNotice parameter into the DOM. HotGo is an open-source Go-based web framework; the affected versions are 1.0 and 2.0 (CPE: cpe:2.3:a:bufanyun:hotgo:*:*:*:*:*:*:*:*).
RemediationAI
No vendor-released patch identified at time of analysis. Given the vendor's non-response to early disclosure, organizations should implement input validation and output encoding at the application level immediately. Upgrade to a patched version if the vendor releases one; alternatively, apply Web Application Firewall (WAF) rules to block malicious script injection attempts targeting the editNotice endpoint. Implement strict Content Security Policy (CSP) headers to mitigate XSS impact. Monitor user input to the /web/src/layout/components/Header/MessageList.vue component and sanitize all data before rendering in the Vue template. For affected deployments, restrict access to the editNotice functionality to trusted administrators only or disable the feature until remediation is available. References: https://vuldb.com/vuln/354443, https://github.com/CC-T-454455/Vulnerabilities/tree/master/hotgo/vulnerability-2
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today