EUVD-2026-36774
GHSA-rqwf-4646-gmv2
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L confirmed as payload injection requires an authenticated session; UI:R required as a separate victim must load the affected page; S:C reflects cross-user browser impact consistent with stored XSS pattern.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
A cross-site scripting (XSS) vulnerability in Deck9 Input v2.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
AnalysisAI
Cross-site scripting in Deck9 Input v2.0.1 enables authenticated attackers to inject arbitrary JavaScript or HTML via crafted input payloads that execute within other users' browser sessions. The CVSS scope-changed vector (S:C, PR:L, UI:R) confirms the impact crosses user boundaries - a single low-privileged attacker can affect multiple victims - though account access and victim interaction are prerequisites. EPSS at 0.15% (4th percentile) and SSVC Exploitation: none indicate no current active exploitation; no CISA KEV listing is present.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or output encoding of user-controlled data before it is rendered in the browser. Deck9 Input v2.0.1 appears to be a form or input-builder component where user-supplied values - such as field labels, descriptions, or submitted responses - are stored and later rendered without adequate HTML encoding. The CVSS scope change (S:C) is characteristic of stored XSS, where the payload persists in application storage and executes in the security context of visiting users rather than only the attacker. The CPE string (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) is unresolved, indicating that NVD/MITRE has not assigned a vendor-attributed CPE, which limits automated scanner detection.
RemediationAI
No vendor-released patch has been identified at time of analysis - no fixed version is referenced in the CVE description, NVD entry, or ENISA EUVD-2026-36774. As a primary compensating control, operators should implement a strict Content Security Policy (CSP) header (e.g., script-src 'self') to block inline script execution from injected payloads; note this may break legitimate inline script usage in the application and requires testing. At the application layer, enforce HTML encoding of all user-supplied input values at the point of output rendering, and consider stripping or escaping HTML tags at ingestion. Restricting the ability to submit rich or unescaped input to trusted roles only (elevating the effective privilege required) reduces exposure. Monitor the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-50876 and the GitHub gist at https://gist.github.com/pyuysig/0f5e37e12f760c3262b420b65eb6d5ae for patch or reproduction updates from the reporter.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today