CVE-2026-100521

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100521
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100521.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100521
Published
2026-09-26T00:59:22Z
Modified
2026-09-27T03:47:23Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Cotonti through 1.0.0 Reflected XSS via search highlight parameter
Details

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor who opens the link, including administrators.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100521.json"
}
References

Affected packages

Git / github.com/cotonti/cotonti

Affected ranges

Type
GIT
Repo
https://github.com/cotonti/cotonti
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0d554e939a315e7f7f18fba3ca1132b80c6a1adb
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.0.0"
        },
        {
            "fixed":  "1.0.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*
0.9.12
0.9.12.1
0.9.13
0.9.14
0.9.15
0.9.16
0.9.16.1
0.9.16.2
0.9.17
0.9.18
0.9.18.1
0.9.19
0.9.19-RC.1
0.9.19-rc1
0.9.20
0.9.20.1
0.9.21
0.9.22
0.9.23
0.9.24
0.9.24.1
0.9.24.2
0.9.25
cotonti-0.*
cotonti-0.9.10
cotonti-0.9.11
cotonti-0.9.11.1
cotonti-0.9.3
cotonti-0.9.6
cotonti-0.9.7
cotonti-0.9.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100521.json"