wrensec-commons EUVD-2026-115250

Exploitation requires sending the victim a crafted GET request to any deployed CREST HTTP-binding endpoint with the _mimeType=text/html request parameter (accepted in the query string or x-www-form-urlencoded body); the unsanitized value is reflected into the Content-Type response header, causing the JSON body to render as HTML. The primary limiting factor is required user interaction (UI:R) - the victim must be induced to open the attacker's link - so the attack depends on social engineering. It is further bound to wrensec-commons json-resource-http versions < 22.6.2 and >= 23.0.0-M1 through < 23.0.0; no non-default configuration is needed since any deployed CREST endpoint is affected. The vendor's only listed workaround is to disallow the _mimeType parameter in both query and form-encoded bodies; otherwise upgrading to 22.6.2 or 23.0.0 is the fix.

CVSS 3.1 base 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable, low-complexity, unauthenticated reflected XSS whose execution requires the victim to click a crafted link (UI:R), with scope change reflecting that the injected script runs in the user's browser rather than the server process. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no signal of active or widespread exploitation; the vuln.today decision label is 'this_month' (routine remediation), not act_now or emergency. No PoC or exploit-code reference appears in the input - only the GHSA advisory and the two patch commits - so exploitation status is 'no public exploit identified at time of analysis.' The real-world risk is moderate and consistent with the score: this is a genuine reflected XSS in a reusable REST framework (so it is exposed on every deployed CREST endpoint), but it is user-interaction-gated and limited to Low confidentiality/integrity impact with no availability effect, making it a this-month patch priority rather than a drop-everything issue. No CVSS-vs-description conflict is present; the description's mechanics match the AV:N/UI:R/S:C vector.

An attacker crafts a URL to any deployed wrensec-commons CREST endpoint appending the _mimeType=text/html query parameter and sends it to a victim via phishing or a malicious page. When the victim's browser follows the link, HttpUtils.prepareResponse() sets the Content-Type header to text/html from the unsanitized parameter, so the browser renders the CREST JSON response as HTML and executes attacker-controlled JavaScript in the victim's session. No public exploit code is referenced in the available sources, though the trigger is fully described in the vendor advisory.