CVE-2026-107798

5.4 Moyenne

Publiée le 09/10/2026 à 00:17 · Modifiée le 14/10/2026 à 19:18 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to execute JavaScript when other users click or hover over rendered links.

Traduire en français

Produits concernés

banq jivejdon

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.1 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.4 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/banq/jivejdon
https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/domain/model/message/output/html/TextStyle.java#L242-L243
https://github.com/banq/jivejdon/issues/28
https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-stored-xss-via-markdown-links-in-textstyle-rendering-filter

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories