LinkStack EUVD-2026-26438

Exploitation requires (1) valid authentication to LinkStack (PR:L in CVSS vector), (2) access to the editPage function with permission to modify page descriptions, and (3) victim interaction with the affected page (UI:P). The vulnerability does NOT affect unauthenticated users or those without edit permissions. Non-default configurations are not required - the vulnerability exists in default deployments where user registration and page editing are enabled. The attack is limited to stored XSS on the specific page being edited; it does not propagate site-wide unless the page description is displayed in global templates.

CVSS v4.0 score of 2.0 reflects the limited scope: PR:L (login required) and UI:P (user interaction needed for impact) substantially reduce real-world attack surface compared to unauthenticated network-based XSS. The CVSS vector shows VI:L (low integrity impact), appropriate for XSS affecting session cookies or sensitive page content rather than system compromise. However, EPSS data is not provided, so exploitation probability cannot be cross-referenced. The presence of publicly available exploit code (E:P in vector) and vendor acknowledgment via pull request (though unmerged at analysis time) indicate this is a recognized, demonstrable vulnerability rather than theoretical. The low CVSS score combined with public POC suggests this is primarily a concern for multi-user LinkStack deployments where authenticated users may be adversarial, rather than a critical internet-facing risk. Defense priority depends on deployment model: self-hosted instances with trusted users face minimal risk; multi-tenant or open-registration scenarios require immediate patching.

An authenticated attacker with page editing privileges creates or edits a page and injects a payload such as '" onmouseover="alert(1)" data-x="' into the pageDescription field. The malicious script is stored in the database. When another user visits the page, the unescaped payload is rendered in their browser, triggering the onmouseover event and executing arbitrary JavaScript in their session context, allowing cookie theft or account hijacking.