https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 05:49:09 +0000 https://db.gcve.eu/vuln/ghsa-g8rh-fjm6-h2h9 <p><strong>Affected:</strong> Go: github.com/lf-edge/ekuiper/v2</p> <p>### Summary A Cross-Site Scripting (XSS) vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user&#39;s browser when rendered by administrative web interfaces.</p> <p>### Details Prior to v2.4.0, external service registration endpoints did not strictly enforce alphanumeric character restrictions on service names. An operator or attacker with API access could register a service using a crafted name containing HTML elements (such as `&lt;iframe src=&#34;...&#34;&gt;`). If an administrative web UI rendered the unescaped service name, arbitrary script execution could occur in the context of the user&#39;s browser session.</p> <p>### PoC 1. Create an external service JSON definition with a filename containing an XSS payload, e.g. `&lt;iframe src=&#34;javascript:alert`1337`&#34;&gt;.json` inside a ZIP archive. 2. In external service creation, upload the ZIP and provide the matching service name: `&lt;iframe src=&#34;javascript:alert`1337`&#34;&gt;`. 3. Upon service registration, the unescaped name executes when rendered in the UI context.</p> <p>### Impact Self-XSS / Stored XSS leading to potential session token leakage or unauthorized actions in the context of the affected user&#39;s browser session.</p> <p>### Remediation &amp; Patches - **Upgrade to eKuiper &gt;= 2.4.0**: Strict alphanumeric identifier validation (`validate.ValidateID`) is now enforced on all external service creation and update endpoints, rejecting invalid characters.</p> <p>### Workarounds - P…</p> <p><strong>Affected:</strong> Go: github.com/lf-edge/ekuiper/v2</p> <p>### Summary A Cross-Site Scripting (XSS) vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user&#39;s browser when rendered by administrative web interfaces.</p> <p>### Details Prior to v2.4.0, external service registration endpoints did not strictly enforce alphanumeric character restrictions on service names. An operator or attacker with API access could register a service using a crafted name containing HTML elements (such as `&lt;iframe src=&#34;...&#34;&gt;`). If an administrative web UI rendered the unescaped service name, arbitrary script execution could occur in the context of the user&#39;s browser session.</p> <p>### PoC 1. Create an external service JSON definition with a filename containing an XSS payload, e.g. `&lt;iframe src=&#34;javascript:alert`1337`&#34;&gt;.json` inside a ZIP archive. 2. In external service creation, upload the ZIP and provide the matching service name: `&lt;iframe src=&#34;javascript:alert`1337`&#34;&gt;`. 3. Upon service registration, the unescaped name executes when rendered in the UI context.</p> <p>### Impact Self-XSS / Stored XSS leading to potential session token leakage or unauthorized actions in the context of the affected user&#39;s browser session.</p> <p>### Remediation &amp; Patches - **Upgrade to eKuiper &gt;= 2.4.0**: Strict alphanumeric identifier validation (`validate.ValidateID`) is now enforced on all external service creation and update endpoints, rejecting invalid characters.</p> <p>### Workarounds - P…</p> https://db.gcve.eu/vuln/ghsa-g8rh-fjm6-h2h9