PT-2026-61615 · Unknown · Datacycle-Core

CVE-2026-32822 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions dataCycle-CORE versions prior to 25.07.4

Description An unauthenticated attacker can perform a reflected DOM XSS (Cross-Site Scripting, where a script is executed in the browser due to unsafe handling of data in the Document Object Model) by placing arbitrary HTML into flash notifications on public routes. The frontend toast component injects this content into the DOM using innerHTML. This can be triggered via a crafted link to public pages, such as the /docs endpoint. Since the vulnerable JavaScript is part of the standard application layout, the issue affects general public pages rather than being limited to debug or admin views.

Recommendations Update dataCycle-CORE to version 25.07.4 or later.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2026-32822

Affected Products

Datacycle-Core

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-32822 · Security Note
• https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-q6x5-wcg6-v4gw · Note
• https://twitter.com/CVEnew/status/2079238911943925815 · Twitter Post