JLSEC-2026-1378

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-1378.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1378.json
JSON Data
https://api.osv.dev/v1/vulns/JLSEC-2026-1378
Upstream
  • EUVD-2026-63496
Published
2026-08-24T13:43:17.899Z
Modified
2026-08-24T14:00:03.449988561Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.

Database specific 
{
    "sources": [
        {
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73254",
            "published": "2026-08-20T18:16:46.113Z",
            "imported": "2026-08-23T06:20:42.739Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-73254",
            "modified": "2026-08-21T17:16:44.093Z",
            "database_specific": {
                "status": "Received"
            },
            "id": "CVE-2026-73254"
        },
        {
            "published": "2026-08-20T17:37:17Z",
            "affected": {
                "Cesanta:Mongoose": [
                    "< 7.22"
                ]
            },
            "imported": "2026-08-23T06:20:06.544Z",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-63496",
            "modified": "2026-08-21T16:22:13Z",
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63496",
            "id": "EUVD-2026-63496"
        }
    ],
    "license": "CC-BY-4.0"
}
References

Affected packages

Julia / Mongoose_jll

Package

Name
Mongoose_jll
Purl
pkg:julia/Mongoose_jll?uuid=0a8a3f5b-4c0e-5906-8e29-5b3fee15539c

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1378.json"