# CVE-2026-35466: CERT/CC cveClient XSS in cveInterface.js

Source: https://junglewise.ai/threats/cve-2026-35466-cert-cc-cveclient-xss-in-cveinterface-js  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-02. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-35466 · Severity: medium · CVSS 6.1 · Published 2026-04-02

A security vulnerability exists in the CERT/CC cveClient, a tool used by organizations to manage and submit vulnerability data. The software incorrectly trusts data received from external CVE API services, which could allow an attacker to inject malicious scripts into the user's browser. If exploited, this could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.

Vendors: [Cmu](https://junglewise.ai/threats/vendors/cmu).

## Quick answers

**Is CVE-2026-35466 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35466 being exploited in the wild.

**How severe is CVE-2026-35466?** Medium severity, with a CVSS score of 6.1, published 2 April 2026.

**Which products and versions are affected?** CERT/CC cveClient up to (excluding) 1.0.24.

**Is there a fix for CVE-2026-35466?** A patch was published on 2026-03-30: Fix merged in pull request #37 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35466 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-35466?** Check whether you run Cmu Cveclient. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the cveInterface.js component of the CERT/CC cveClient library. The root cause is a failure to sanitize or neutralize input received from CVE API services, leading to a 'trusting input' flaw (CWE-79). An attacker who can influence the data returned by a CVE API service can inject malicious HTML or JavaScript that executes in the context of the user's browser session. This is a network-based attack requiring minimal user interaction (viewing the affected data). The issue is resolved in version 1.0.24.

## Affected products

- CERT/CC cveClient up to (excluding) 1.0.24

## Timeline

- 2026-03-30: patched: Fix merged in pull request #37
- 2026-04-02: disclosed: Initial CVE publication
- 2026-06-03: advisory: NVD analysis and CPE information added

## References

- [https://github.com/CERTCC/cveClient](https://github.com/CERTCC/cveClient)
- [https://github.com/CERTCC/cveClient/pull/37](https://github.com/CERTCC/cveClient/pull/37)

## Related threats

- [CERT/CC cveClient insufficient protection of credentials in browser storage](https://junglewise.ai/threats/cve-2026-35467-cert-cc-cveclient-insufficient-protection-of-credentials-in)