CVE-2026-27639

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27639
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27639.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27639
Aliases
  • GHSA-65p7-pph2-966g
Published
2026-02-25T03:44:26.241Z
Modified
2026-03-02T08:04:46.730081Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Mercator vulnerable to stored XSS via unescaped Blade directives in display templates
Details

Mercator is an open source web application designed to enable mapping of information systems. A stored Cross-Site Scripting (XSS) vulnerability exists in Mercator prior to version 2026.02.22 due to the use of unescaped Blade directives ({!! !!}) in display templates. An authenticated user with the User role can inject arbitrary JavaScript payloads into fields such as "contact point" when creating or editing entities. The payload is then executed in the browser of any user who views the affected page, including administrators. Version 2026.02.22 fixes the vulnerability.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27639.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/dbarzin/mercator

Affected ranges

Type
GIT
Repo
https://github.com/dbarzin/mercator
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f82430b18ae79339234a3cf191c5d58b165458d1

Affected versions

1.*
1.0
1.1
2024.*
2024.11.R1
2024.12.1
2025.*
2025.01.11
2025.03.21
2025.10.03
2025.10.12
2025.11.10
2025.11.12
2025.12.01
2026.*
2026.01.02
2026.01.09
2026.01.15
2026.01.16
2026.01.19
2026.01.26
2026.02.04
2026.02.06
2026.02.08
2026.02.09
2026.02.13
2026.02.15
2026.02.17
mercator-0.*
mercator-0.1.0
mercator-0.2.0
mercator-2.*
mercator-2.0.0
mercator-2.0.4
mercator-2.0.5
mercator-2.1.0
mercator-2025.*
mercator-2025.04.27
v1.*
v1.b
v1.c
v2024-09.*
v2024-09.stable
v2024-10.*
v2024-10.stable

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27639.json"