PT-2026-38586 · Vvveb · Vvveb

Basant Kumar + 2 · Published 2026-05-07 · Updated 2026-05-10 · CVE-2026-41929

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.2

Description An unauthenticated reflected cross-site scripting issue exists in the visual editor preview renderer. Attackers can execute arbitrary JavaScript by manipulating the r query parameter and component ajax POST parameter. This occurs because the isEditor() function does not perform session, role, or token verification, and the view handler injects raw HTML POST body content without sanitization. Attackers can use a malicious link or an auto-submitted form to execute controlled JavaScript within the context of the Vvveb origin.

Recommendations Update to version 1.0.8.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41929

Affected Products

Vvveb

References · 8

• 🔥 https://github.com/givanz/Vvveb/security/advisories/GHSA-wwmv-4g9g-p48g · Exploit
• https://github.com/givanz/Vvveb/commit/54a9e846fb94192f1b31ae81d81d25c874662e6a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41929 · Security Note
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.2 · Note
• https://twitter.com/CVEnew/status/2053559192544256371 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052607035196191055 · Twitter Post
• https://vulncheck.com/advisories/vvveb-unauthenticated-reflected-xss-via-visual-editor · Note
• https://t.me/CVEtracker/53038 · Telegram Post