Quick answers
- Is CVE-2026-27742 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-27742 being exploited in the wild.
- How severe is CVE-2026-27742?
- Medium severity, with a CVSS score of 5.4, published 23 February 2026.
- Which products and versions are affected?
- Bludit <= 3.16.2.
- Is there a fix for CVE-2026-27742?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-27742 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-27742?
- Check whether you run Bludit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Bludit version 3.16.2 within the post content functionality. The root cause is a failure to implement server-side input validation; while the application performs client-side sanitization, an attacker can bypass this by intercepting the request and injecting arbitrary JavaScript into the 'content' parameter. This malicious payload is stored in the database and executed in the context of any user who views the affected post. An authenticated attacker with permissions to create or edit content can leverage this to perform session hijacking, credential theft, or unauthorized actions on behalf of other users. As of the advisory date, the issue was reported in version 3.16.2 and remains a known risk for versions up to and including that release.
Affected products
- Bludit Bludit <= 3.16.2
Timeline
- 2024-08-29: disclosed: Initial issue reported on GitHub by catalin-iovita
- 2026-02-23: advisory: NVD and VulnCheck published advisory details