Vulnerability-Lookup EUVD-2026-57219

Write-side exploitation requires an authenticated account holding either the vulnerability:create or vulnerability:modify permission within the Vulnerability-Lookup application - this is the concrete prerequisite. The attacker must submit a crafted value into the containers.cna.references[].tags[] field of a vulnerability record via the CNA API; no other field or feature is involved. Once the payload is stored, no further attacker interaction is needed. Victim-side triggering requires only that a user loads the public /cve/<id> or /vuln/<id> page corresponding to the poisoned record in a JavaScript-enabled browser (UI:A from the CVSS vector) - victims do not need any account or session. Exploitation is limited by: the requirement for a write-permission account (attacker must be registered and credentialed); the need for victim page load (no drive-by without user navigation); and the absence of any indication that the vulnerability is being actively exploited or that exploit code is publicly circulating beyond the patch test case. Deployments where all write-permission holders are fully trusted internal staff face negligible real-world risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N) warrants close reading: the PR:N metric reflects that victims require no privileges to trigger execution simply by visiting a page, but the write-side prerequisite - a vulnerability:create or vulnerability:modify account - means the attacker role is not anonymous. This attacker-victim role asymmetry is not fully captured in the base vector and should inform triage. The SC:H rating for subsequent-system confidentiality is appropriate given that Vulnerability-Lookup users may be security researchers or incident responders whose browser sessions carry sensitive context. No EPSS data was supplied and this CVE does not appear in CISA KEV, indicating no confirmed widespread exploitation. The patch commit itself includes a functional XSS payload in its test case, materially lowering the barrier for any would-be reproducer and making rapid patching more urgent than the moderate base score alone might suggest. Even a mid-sized municipal IT team in mielec self-hosting this platform for internal vulnerability tracking should treat this as a near-term priority if any external contributor accounts with write permissions exist, since the attack surface expands proportionally with the number of trusted reporter accounts. Overall real-world risk is moderate for isolated internal deployments and meaningfully higher for publicly accessible instances with open CNA contributor registration.

An attacker holding a vulnerability:create account on a target Vulnerability-Lookup instance submits a new vulnerability record via the CNA API with a reference tag containing a crafted payload such as the one demonstrated in the fix's test suite: an img element with an onerror handler. The record is stored and the payload is rendered unsanitized on the public /cve/<id> page accessible to all visitors. When a security analyst, unauthenticated researcher, or any browser user loads that page, the JavaScript executes in the context of the Vulnerability-Lookup origin, enabling the attacker to exfiltrate session cookies, perform authenticated actions on behalf of the victim, or inject further content into the page.