CVE-2026-55891: PrivateBin reflected JSON injection in jsonld endpoints

CVE-2026-55891 · Severity: low · CVSS 3.1 · Published 2026-08-28

PrivateBin's JSON-LD API endpoints fail to properly escape user-supplied request URLs before inserting them into JSON responses. An attacker can craft a malicious request URL containing special characters (like quotes) that breaks out of the JSON structure, allowing injection of arbitrary key-value pairs into the response. The response is served with CORS headers and lacks MIME-type protection, potentially enabling structured-data consumers or other clients to misinterpret the injected content.

Technologies: privatebin/privatebin (Packagist), PrivateBin. Vendors: Packagist, PrivateBin.

Quick answers

Is CVE-2026-55891 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55891 being exploited in the wild.
How severe is CVE-2026-55891?
Low severity, with a CVSS score of 3.1, published 28 August 2026.
Which products and versions are affected?
privatebin/privatebin (Packagist) <= 2.0.4, ECOSYSTEM:introduced=0,fixed=2.0.5; PrivateBin <= 2.0.4.
Is there a fix for CVE-2026-55891?
Yes. privatebin/privatebin (Packagist): upgrade to 2.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55891 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55891?
Check whether you run privatebin/privatebin (Packagist) or PrivateBin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • privatebin/privatebin (Packagist): upgrade to 2.0.5 or later
    composer require privatebin/privatebin:^2.0.5

Technical details

The vulnerability is an improper output encoding bug (CWE-116) in PrivateBin's JSON-LD endpoint handler. The root cause lies in the `Request::getRequestUri()` method, which uses PHP's `FILTER_SANITIZE_URL` filter—a function that does not strip quote characters (`"`, `'`), angle brackets (`<`, `>`), or other JSON-special characters. The unsanitized URI is then directly inserted into JSON-LD template files via `str_replace()` in `Controller::_jsonld()` without JSON-escaping, allowing an attacker to break out of a JSON string and inject arbitrary keys and values. For example, a request to `/?jsonld=types&x="injected":"pwned","y":"` would result in these quote characters being reflected unescaped into the response body. Additionally, the jsonld code path bypasses standard security headers (notably `X-Content-Type-Options: nosniff`), and the endpoint sets `Access-Control-Allow-Origin: *`, creating a defense-in-depth gap. No direct script execution has been demonstrated on modern browsers since JSON-LD is not HTML-sniffed, but the issue can be exploited by structured-data consumers or combined with other vulnerabilities. The fix requires proper JSON escaping of the URL before insertion and application of missing security headers.

Affected products

  • PrivateBin PrivateBin <= 2.0.4

Identifiers

  • CVE-2026-55891
  • GHSA-xrjc-c68j-hp7w

Timeline

  • 2026-07-11: disclosed
  • 2026-08-28: patched: Fixed in version 2.0.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.