CVE-2026-45231

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45231
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45231.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45231
Published
2026-05-18T18:40:42Z
Modified
2026-08-12T03:51:18Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset Fields
Details

DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, description, modelNumber, serialNumber, and tags that are stored without server-side sanitization and rendered using innerHTML without client-side escaping. Attackers can create or update assets with HTML or JavaScript payloads via the asset API endpoints to execute arbitrary scripts in the browsers of users viewing the asset list, and with Content-Security-Policy disabled, the injected scripts can make unrestricted connections to internal network services.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45231.json"
}
References

Affected packages

Git / github.com/dumbwareio/dumbassets

Affected ranges

Type
GIT
Repo
https://github.com/dumbwareio/dumbassets
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0868fe328fd1118a680fc3f2871f920c46f68976
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.11"
        },
        {
            "fixed": "1.0.11"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v1.*
v1.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45231.json"