Executive brief
A security vulnerability exists in the CERT/CC cveClient, a tool used by organizations to manage and submit vulnerability data. The software incorrectly trusts data received from external CVE API services, which could allow an attacker to inject malicious scripts into the user's browser. If exploited, this could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the cveInterface.js component of the CERT/CC cveClient library. The root cause is a failure to sanitize or neutralize input received from CVE API services, leading to a 'trusting input' flaw (CWE-79). An attacker who can influence the data returned by a CVE API service can inject malicious HTML or JavaScript that executes in the context of the user's browser session. This is a network-based attack requiring minimal user interaction (viewing the affected data). The issue is resolved in version 1.0.24.
Affected products
- CERT/CC cveClient up to (excluding) 1.0.24
Timeline
- 2026-03-30: patched: Fix merged in pull request #37
- 2026-04-02: disclosed: Initial CVE publication
- 2026-06-03: advisory: NVD analysis and CPE information added