Executive brief
dataCycle-CORE, a data management system used for centralizing and distributing information, contains a security flaw in how it handles notifications. An attacker could send a specially crafted link to a user that, when clicked, executes malicious code in the user's browser. This could allow the attacker to perform actions on behalf of the user or steal sensitive information within the application session.
Technical details
A reflected DOM-based Cross-Site Scripting (XSS) vulnerability exists in dataCycle-CORE versions up to and including 25.07.3. The vulnerability is located in the core processing module's handling of flash notifications on public routes. The frontend toast component improperly uses `innerHTML` to render notification content, allowing an unauthenticated attacker to inject arbitrary HTML/JavaScript via a crafted URL. Because the vulnerable JavaScript is part of the standard application layout, the attack can be executed against any public page (e.g., /docs). A patch is available in version 26.06.08.
Affected products
- datacycle-engine dataCycle-CORE <= 25.07.3
Timeline
- 2026-06-24: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD
- 2026-06-24: patched: Version 26.06.08 released to address the issue