PT-2026-21855 · Mercator · Mercator

Hadhub · Publicado 2026-02-25 · Atualizado 2026-02-27 · CVE-2026-27639

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mercator versions prior to 2026.02.22

Description Mercator is a web application for mapping information systems. A stored Cross-Site Scripting (XSS) issue exists because of the use of unescaped Blade directives ({!! !!}) in display templates. An authenticated user with the User role can inject JavaScript payloads into fields like "contact point" when creating or editing entities. This injected code executes in the browsers of users viewing the affected page, potentially including administrators. The vulnerable component uses unescaped Blade directives, which allow for the execution of arbitrary code within the application's context.

Recommendations Update to version 2026.02.22 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-27639

GHSA-65P7-PPH2-966G

Produtos afetados

Mercator

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27639.json · Exploit
• https://github.com/dbarzin/mercator/security/advisories/GHSA-65p7-pph2-966g · Aviso do Fabricante
• https://github.com/dbarzin/mercator/commit/839d231399944e43a865198262e96e0218252cc3 · Correção
• https://github.com/dbarzin/mercator/commit/9902ffd91f287e474729f514c77261f4ef7db8fe · Correção
• https://github.com/dbarzin/mercator/commit/c58bb1d2fff18605c61d93cfaf77adca416c560a · Correção
• https://t.me/CVEtracker/45681 · Publicação no Telegram
• https://t.me/cveNotify/153099 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2026641352511934759 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2026545501630333084 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27639 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-27639 · Aviso do Fabricante
• https://t.me/cveNotify/153561 · Publicação no Telegram