{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-2102","assignerOrgId":"b6ef82d7-f637-461b-aedd-74f5857d5f5b","state":"PUBLISHED","assignerShortName":"WrenSecurity","dateReserved":"2026-02-06T13:04:37.324Z","datePublished":"2026-11-02T15:26:54.677Z","dateUpdated":"2026-11-02T16:14:41.537Z"},"containers":{"cna":{"providerMetadata":{"orgId":"b6ef82d7-f637-461b-aedd-74f5857d5f5b","shortName":"WrenSecurity","dateUpdated":"2026-11-02T15:26:54.677Z"},"title":"XSS in wrensec-commons CREST framework HTTP binding via _mimeType parameter","datePublic":"2026-11-02T15:00:00.000Z","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"impacts":[{"descriptions":[{"lang":"en","value":"XSS Using HTTP Query Strings"}]}],"affected":[{"vendor":"Wren Security","product":"wrensec-commons","collectionURL":"https://repo1.maven.org/maven2","packageName":"org.wrensecurity.commons:json-resource-http","repo":"https://github.com/WrenSecurity/wrensec-commons/","versions":[{"status":"affected","version":"0","lessThan":"22.6.2","versionType":"semver"},{"status":"affected","version":"23.0.0-M1","lessThan":"23.0.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0.</p>"}]}],"references":[{"url":"https://github.com/WrenSecurity/wrensec-commons/security/advisories/GHSA-4vhv-49g2-496q","name":"GitHub Security Advisory GHSA-4vhv-49g2-496q","tags":["third-party-advisory"]},{"url":"https://github.com/WrenSecurity/wrensec-commons/commit/65bbfd8c63c42e84ff7699aa5b82a22c08a12624","name":"Fix commit (23.x): Remove implicit support for _mimeType parameter to prevent XSS attacks","tags":["patch"]},{"url":"https://github.com/WrenSecurity/wrensec-commons/commit/5b50c64c14943b6f4d7faf996345e603956bae1d","name":"Fix commit (22.x backport): Remove implicit support for _mimeType parameter to prevent XSS attacks","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":6.1,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}],"workarounds":[{"lang":"en","value":"Disallow the _mimeType request parameter in both query string and x-www-form-urlencoded request bodies.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Disallow the _mimeType request parameter in both query string and x-www-form-urlencoded request bodies.</p>"}]}],"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-11-02T16:14:26.559086Z","id":"CVE-2026-2102","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-11-02T16:14:41.537Z"}}]}}