Part-DB EUVD-2026-108576

Exploitation requires two authenticated users on the same Part-DB instance: an attacker holding permission to create or edit a Part name (reproduced with the non-admin Editor preset) who stores HTML markup in a Part name, and a victim holding permission to import a BOM into a Project. The payload fires only when the victim imports a BOM CSV that references the attacker-controlled Part ID AND the BOM validation result page renders an information message - the PoC deliberately includes an invalid quantity/designator row to force that validation result to render. Limiting factors: authenticated low-privilege access is needed (not remote-unauthenticated), the victim must actively perform a BOM import (user interaction), and the stored CSP reportedly blocks inline JavaScript so impact is confined to HTML injection (links, forms, tracking images, CSS-based UI redressing) rather than script execution or direct data compromise. Affected versions are <= 2.12.1; the only stated complete fix is updating to 2.12.2.

This is a cross-user stored HTML injection (CWE-79) in Part-DB with a CVSS 4.0 base score of 5.7 (medium). The input provides no CISA KEV listing and no EPSS probability, so exploitation status is: no public exploit identified as active exploitation, but a detailed public PoC reference exists in the GHSA advisory (step-by-step payload and CSV) - it is not packaged as a verified working exploit tool. The CVSS 4.0 vector tempers the raw concern: PR:L means the attacker must already hold an authenticated low-privileged account (reproduced with the non-admin Editor preset), UI:A means the victim must actively import a BOM, and AT:P reflects that a validation message must actually render (the PoC forces this with an intentionally invalid CSV row). Impact is integrity-only (VI:H in the supplied vector; VC:N/VA:N) and, critically, the reporter states the current Content Security Policy blocks inline JavaScript, so this is HTML injection for phishing/UI-redressing/tracking - not script execution or data theft. The vuln.today decision label is 'this_month', not act_now or emergency, consistent with a medium-severity issue that needs two cooperating-or-targeted user roles. Net: a real but moderate-priority issue - patch on a normal cycle rather than as an emergency, with higher relevance for multi-user Part-DB instances where low-trust Editor accounts exist.

A low-privileged Editor user edits a Part name to contain HTML markup (for example a red, large 'Re-authenticate' link pointing to an attacker domain). Later, a different user imports a BOM CSV that references that Part ID into a Project, and the BOM validation result page renders the stored Part name through Twig's |raw filter, so the attacker's HTML appears inside the trusted Part-DB page and can be used for phishing or UI redressing. A detailed public PoC with the exact payload and CSV is included in the GHSA advisory; JavaScript is reportedly blocked by CSP, so the scenario is HTML/link/form injection rather than script execution.