EUVD-2026-49567
GHSA-c2q2-868h-6pj2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (Cribl) · only source for this CVE.
CVSS VectorVendor: Cribl
Lifecycle Timeline
3DescriptionCVE.org
Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value.
AnalysisAI
Arbitrary JavaScript execution in Cribl Stream before 4.18.2 allows authenticated attackers with edit privileges to run arbitrary code on the server via crafted database connection identifiers or pack configuration values. The vulnerability stems from improper code generation in the JSON Pointer-to-accessor compiler. No public exploit or active exploitation has been reported.
More in Cribl Stream
View allArbitrary code execution in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipel
Information disclosure in Cribl Stream versions prior to 4.17.1 allows authenticated remote attackers with low privilege
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today