Refinedev Inferencer
Monthly
Refine's @refinedev/inferencer package through version 7.0.0 interpolates API field names straight into generated JSX source without escaping, so an attacker who controls or has compromised the data provider can supply crafted JSON property names that execute as JavaScript in a developer's browser when an Inferencer-generated page renders. Remote, unauthenticated input is possible per the published vector (PR:N), but exploitation is gated on developer interaction (UI:P/UI:R), a malicious or untrusted backend (AC:H/AT:P), and a developer actually previewing Inferencer output - hence our independent assessment rates real-world risk materially below the 7.7 CVSS 4.0 headline, and no public exploit code was identified at time of analysis. The issue is tracked upstream in the refinedev/refine repository as issue #7556.
Refine's @refinedev/inferencer package through version 7.0.0 interpolates API field names straight into generated JSX source without escaping, so an attacker who controls or has compromised the data provider can supply crafted JSON property names that execute as JavaScript in a developer's browser when an Inferencer-generated page renders. Remote, unauthenticated input is possible per the published vector (PR:N), but exploitation is gated on developer interaction (UI:P/UI:R), a malicious or untrusted backend (AC:H/AT:P), and a developer actually previewing Inferencer output - hence our independent assessment rates real-world risk materially below the 7.7 CVSS 4.0 headline, and no public exploit code was identified at time of analysis. The issue is tracked upstream in the refinedev/refine repository as issue #7556.