# CVE-2026-48118: NukeViet reflected XSS in Comment Module

Source: https://junglewise.ai/threats/cve-2026-48118-nukeviet-reflected-xss-in-comment-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-48118 · Severity: high · CVSS 8.2 · Published 2026-07-13

NukeViet, an open-source content management system, contains a vulnerability in its comment module that allows attackers to execute malicious scripts in a user's browser. By tricking a user into clicking a specially crafted link, an attacker could steal login credentials or perform actions on the user's behalf. This is made easier by a secondary flaw where security tokens meant to prevent such attacks are not unique to each user, allowing them to be easily predicted or reused.

Technologies: [NukeViet](https://junglewise.ai/threats/technologies/nukeviet), [nukeviet/nukeviet (Packagist)](https://junglewise.ai/threats/technologies/nukeviet-nukeviet). Vendors: [NukeViet](https://junglewise.ai/threats/vendors/nukeviet), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-48118 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48118 being exploited in the wild.

**How severe is CVE-2026-48118?** High severity, with a CVSS score of 8.2, published 13 July 2026.

**Which products and versions are affected?** NukeViet < 4.5.09; nukeviet/nukeviet (Packagist) < 4.5.09, ECOSYSTEM:introduced=0,fixed=4.6.00.

**Is there a fix for CVE-2026-48118?** Yes. nukeviet/nukeviet (Packagist): upgrade to 4.6.00 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48118 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-48118?** Check whether you run NukeViet or nukeviet/nukeviet (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nukeviet/nukeviet (Packagist): upgrade to 4.6.00 or later

  ```sh
  composer require nukeviet/nukeviet:^4.6.00
  ```


## Technical details

The vulnerability consists of two flaws in the NukeViet Comment module. First, the 'status_comment' parameter is sanitized before being base64-decoded, allowing encoded HTML/JavaScript payloads to bypass filters and execute in the victim's browser when rendered unescaped. Second, the 'checkss' anti-forgery token is derived from a site-wide static constant ('NV_CACHE_PREFIX') rather than a per-session value, making it predictable and reusable across different users. An unauthenticated attacker can obtain a valid 'checkss' token from the public HTML and construct a malicious URL that, when visited by a victim, executes arbitrary JavaScript. This can lead to credential theft via phishing overlays or session hijacking. The issue is fixed in version 4.6.00 by binding tokens to user sessions and escaping output before rendering.

## Affected products

- NukeViet NukeViet < 4.5.09

## Identifiers

- CVE-2026-48118
- GHSA-mxpf-qgg6-v3ff

## Timeline

- 2026-07-13: advisory: GitHub Advisory GHSA-mxpf-qgg6-v3ff published
- 2026-07-13: disclosed

## References

- [https://api.github.com/users/hoaquynhtim99](https://api.github.com/users/hoaquynhtim99)
- [https://github.com/hoaquynhtim99](https://github.com/hoaquynhtim99)
- [https://api.github.com/users/hoaquynhtim99/gists%7B/gist_id%7D](https://api.github.com/users/hoaquynhtim99/gists%7B/gist_id%7D)
- [https://api.github.com/users/hoaquynhtim99/repos](https://api.github.com/users/hoaquynhtim99/repos)
- [https://avatars.githubusercontent.com/u/2421714?v=4](https://avatars.githubusercontent.com/u/2421714?v=4)
- [https://api.github.com/users/hoaquynhtim99/events%7B/privacy%7D](https://api.github.com/users/hoaquynhtim99/events%7B/privacy%7D)

## Related threats

- [NukeViet SSRF via X-Forwarded-Host in server_info_update](https://junglewise.ai/threats/cve-2026-55372-nukeviet-ssrf-via-x-forwarded-host-in-server-info-update)
- [NukeViet path traversal in Edit Comment function](https://junglewise.ai/threats/cve-2026-54065-nukeviet-path-traversal-in-edit-comment-function)
- [NukeViet stored XSS via filter bypass in News module](https://junglewise.ai/threats/cve-2026-54064-nukeviet-stored-xss-via-filter-bypass-in-news-module)
- [NukeViet CMS stored XSS in comment reply component](https://junglewise.ai/threats/cve-2026-49259-nukeviet-cms-stored-xss-in-comment-reply-component)
- [NukeViet CMS Stored XSS in Request class](https://junglewise.ai/threats/cve-2026-41147-nukeviet-cms-stored-xss-in-request-class)