CVE-2026-26997

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-26997
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26997.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-26997
Aliases
  • GHSA-97r6-4hmx-hcrh
Published
2026-02-27T19:15:11.123Z
Modified
2026-04-02T13:19:45.899688Z
Severity
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P CVSS Calculator
Summary
ClipBucket v5 has Stored XSS via Collection name
Details

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, a normal authenticated user can store the XSS payload. The payload is triggered by administrator. Version 5.5.3 #59 fixes the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26997.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/macwarrior/clipbucket-v5

Affected ranges

Type
GIT
Repo
https://github.com/macwarrior/clipbucket-v5
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2da4c8e41f9e4baf47ff89f8a674fbe9b63ac76d

Affected versions

5.*
5.3
5.3.1
5.4.0
5.4.1
5.5.0
5.5.1
5.5.2
5.5.2-#103
5.5.2-#106
5.5.2-#114
5.5.2-#117
5.5.2-#120
5.5.2-#123
5.5.2-#129
5.5.2-#133
5.5.2-#135
5.5.2-#138
5.5.2-#140
5.5.2-#147
5.5.2-#152
5.5.2-#162
5.5.2-#163
5.5.2-#164
5.5.2-#182
5.5.2-#187
5.5.2-#25
5.5.2-#38
5.5.2-#4
5.5.2-#45
5.5.2-#58
5.5.2-#69
5.5.2-#74
5.5.2-#82
5.5.2-#86
5.5.2-#90
5.5.2-#98
5.5.3-#10
5.5.3-#46
5.5.3-#50

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "5.3"
            },
            {
                "fixed": "5.5.3-59"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26997.json"