CVE-2026-2102
wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST…
- Risk score
- 40/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 2 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an att…
- Affected
- See advisory
- Fix
- Upgrade the product to 22.6.2 or 23.0.0 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.1 medium
References
Original description
wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0.
Last activity 2 Nov 2026. Patch Forecast updates every hour.