EUVD-2026-63498Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network-reachable with no auth required, but victim must click link; scope unchanged as XSS executes only within the Mongoose origin with limited C/I impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the decoded request URI into the title and h1 elements without HTML entity encoding. The resulting reflected cross-site scripting executes in the Mongoose origin and can expose session data or perform actions as the victim. This issue is fixed in version 7.22.
AnalysisAI
Reflected cross-site scripting in Cesanta Mongoose (all versions prior to 7.22) allows a remote unauthenticated attacker to inject arbitrary JavaScript into a victim's browser by crafting a percent-encoded URL path targeting the directory listing handler. The mg_http_serve_dir() and listdir() functions in src/http.c insert the decoded request URI directly into <title> and <h1> HTML elements without HTML entity escaping, and the resulting script executes in the Mongoose origin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two explicit prerequisites must both be satisfied: (1) the target Mongoose server was compiled with the `MG_ENABLE_DIRLIST` compile-time flag - this is non-default and requires deliberate opt-in at build time, so most Mongoose deployments are not affected; and (2) the attacker must persuade a victim user to visit a crafted URL (UI:R per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.4 (Medium) reflects the moderate but real-world constrained nature of this flaw: AV:N/AC:L/PR:N confirm a network-reachable, low-complexity, unauthenticated attack surface, while UI:R and S:U cap the impact by requiring victim interaction and containing blast radius to the Mongoose origin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers a Mongoose-based embedded web interface with `MG_ENABLE_DIRLIST` compiled in and crafts a URL containing a percent-encoded XSS payload in the path component, such as `/%3Cscript%3Ealert(document.cookie)%3C/script%3E`. The attacker distributes the link via phishing email or embeds it in a third-party page; when an authenticated victim clicks the link, the Mongoose server decodes the path, inserts it unescaped into the directory listing page's `<title>` and `<h1>` elements, and the injected script executes in the victim's browser under the Mongoose origin, exfiltrating session tokens or submitting authenticated requests on their behalf. … |
| Remediation | Upgrade to Mongoose 7.22 or later; the patched release is available at https://github.com/cesanta/mongoose/releases/tag/7.22, and the underlying code change is in PR #3611 (commit a9df523f76f43a38bd53b4232b9cfd4c16869e71). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Mongoose ODM for Node.js before version 8.9.5 contains a search injection vulnerability when using $where filters with p
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. Rated crit
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. Rated critical severity (CVSS 9.8), this vu
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. Rated critical severity (CVSS 9.8), this vu
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infin
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. Rated critical severity (CVSS 9.1
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OO
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connect
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today