Quick answers
- Is CVE-2026-107870 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-107870 being exploited in the wild.
- How severe is CVE-2026-107870?
- High severity, with a CVSS score of 7.1, published 14 October 2026.
- Which products and versions are affected?
- Crocoblock JetEngine through 3.8.16.
- Is there a fix for CVE-2026-107870?
- Yes: fixed in 3.8.16.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-107870 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-107870?
- Check whether you run Crocoblock JetEngine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 3.8.16.1
Technical details
A DOM-based XSS vulnerability exists in JetEngine's web page generation that fails to properly neutralize user-supplied input, allowing attackers to inject arbitrary scripts. The vulnerability requires user interaction and can be triggered by unauthenticated attackers, but successful exploitation depends on a privileged user (e.g., admin) clicking a malicious link or visiting a crafted page. The vulnerability is fixed in version 3.8.16.1.
Affected products
- Crocoblock JetEngine through 3.8.16
Timeline
- 2026-10-12: disclosed: Reported to Patchstack
- 2026-10-14: advisory