CVE-2026-112102

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-112102

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112102.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-112102

Published

2026-10-19T09:45:15Z

Modified

2026-10-24T02:50:57Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

AXA Group NLP.js Condition Expression Pipeline evaluator.js Evaluator.walkFunction code injection

Details

A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-74",
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112102.json"
}

References

Affected packages

Git / github.com/axa-group/nlp.js

Affected ranges

Type

GIT

Repo

https://github.com/axa-group/nlp.js

Events

Introduced

ce35f4e94c66a571471d24b10e1534a305842263

Last Affected

ce35f4e94c66a571471d24b10e1534a305842263

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "4.27.0"
                },
                {
                    "last_affected":  "4.27.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        }
    ]
}

Affected versions

4.*

4.27.0

v4.*

v4.27.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112102.json"