CVE-2026-114396

7.1 Élevée

Publiée le 21/10/2026 à 15:18 · Modifiée le 21/10/2026 à 23:17 · Reçue · Source : disclosure@vulncheck.com

Description

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.

Traduire en français

Produits concernés

polonel trudesk

Scores CVSS

Version	Score	Source	Vecteur
4.0	7.1 Élevée	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	7.1 Élevée	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H`

Faiblesses (CWE)

CWE-943

Références

https://github.com/polonel/trudesk
https://github.com/polonel/trudesk/blob/v1.2.11/src/models/ticket.js#L1184-L1215
https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
https://www.vulncheck.com/advisories/trudesk-through-1.2.11-mongodb-where-injection-via-tickets-search-api
https://hackmd.io/@leediay/multiple-vuln-trudesk-1211

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories