CVE-2026-92706

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92706
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92706.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92706
Aliases
  • GHSA-jh5x-rphw-x532
Published
2026-09-22T15:22:07Z
Modified
2026-09-26T03:30:57Z
Severity
  • 3.4 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N CVSS Calculator
Summary
Dark Reader: Ability to request icon-like bitmap data from certain local web servers
Details

Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like HTTPS URL and is detected as requiring inversion. This behavior can cross the website-to-local-network boundary and disclose limited information associated with the requested resource. The darkreader npm package used for website integration is not affected. This issue is fixed in version 4.9.126 for Firefox and version 4.9.128 for other browsers.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200",
        "CWE-346",
        "CWE-668"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92706.json"
}
References

Affected packages

Git / github.com/darkreader/darkreader

Affected ranges

Type
GIT
Repo
https://github.com/darkreader/darkreader
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
62199fd4a9ab3e95b1b0c3caa7cb67bf209d3a2d
Fixed
f716361ba93e90b91674a0d519b2c3d3425d7f90
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "4.9.128"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.3.0
v2.*
v2.3.1
v3.*
v3.5.4
v4.*
v4.9.10
v4.9.100
v4.9.101
v4.9.102
v4.9.103
v4.9.104
v4.9.105
v4.9.106
v4.9.107
v4.9.108
v4.9.109
v4.9.11
v4.9.110
v4.9.112
v4.9.113
v4.9.114
v4.9.115
v4.9.116
v4.9.117
v4.9.118
v4.9.119
v4.9.12
v4.9.120
v4.9.121
v4.9.122
v4.9.123
v4.9.124
v4.9.125
v4.9.126
v4.9.127
v4.9.13
v4.9.14
v4.9.15
v4.9.16
v4.9.17
v4.9.18
v4.9.19
v4.9.20
v4.9.21
v4.9.22
v4.9.23
v4.9.24
v4.9.25
v4.9.26
v4.9.27
v4.9.28
v4.9.29
v4.9.30
v4.9.31
v4.9.32
v4.9.33
v4.9.34
v4.9.35
v4.9.36
v4.9.37
v4.9.37.1
v4.9.39
v4.9.40
v4.9.41
v4.9.42
v4.9.43
v4.9.44
v4.9.45
v4.9.46
v4.9.47
v4.9.48
v4.9.49
v4.9.50
v4.9.51
v4.9.52
v4.9.53
v4.9.54
v4.9.55
v4.9.56
v4.9.57
v4.9.58
v4.9.59
v4.9.60
v4.9.61
v4.9.62
v4.9.63
v4.9.64
v4.9.65
v4.9.66
v4.9.67
v4.9.68
v4.9.69
v4.9.70
v4.9.71
v4.9.72
v4.9.73
v4.9.74
v4.9.75
v4.9.76
v4.9.77
v4.9.78
v4.9.79
v4.9.8
v4.9.80
v4.9.81
v4.9.82
v4.9.83
v4.9.84
v4.9.85
v4.9.86
v4.9.87
v4.9.88
v4.9.89
v4.9.89.1
v4.9.9
v4.9.90
v4.9.92
v4.9.94
v4.9.95
v4.9.96
v4.9.97
v4.9.98
v4.9.99

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92706.json"