Executive brief
PrivateBin's JSON-LD API endpoints fail to properly escape user-supplied request URLs before inserting them into JSON responses. An attacker can craft a malicious request URL containing special characters (like quotes) that breaks out of the JSON structure, allowing injection of arbitrary key-value pairs into the response. The response is served with CORS headers and lacks MIME-type protection, potentially enabling structured-data consumers or other clients to misinterpret the injected content.
Technical details
The vulnerability is an improper output encoding bug (CWE-116) in PrivateBin's JSON-LD endpoint handler. The root cause lies in the `Request::getRequestUri()` method, which uses PHP's `FILTER_SANITIZE_URL` filter—a function that does not strip quote characters (`"`, `'`), angle brackets (`<`, `>`), or other JSON-special characters. The unsanitized URI is then directly inserted into JSON-LD template files via `str_replace()` in `Controller::_jsonld()` without JSON-escaping, allowing an attacker to break out of a JSON string and inject arbitrary keys and values. For example, a request to `/?jsonld=types&x="injected":"pwned","y":"` would result in these quote characters being reflected unescaped into the response body. Additionally, the jsonld code path bypasses standard security headers (notably `X-Content-Type-Options: nosniff`), and the endpoint sets `Access-Control-Allow-Origin: *`, creating a defense-in-depth gap. No direct script execution has been demonstrated on modern browsers since JSON-LD is not HTML-sniffed, but the issue can be exploited by structured-data consumers or combined with other vulnerabilities. The fix requires proper JSON escaping of the URL before insertion and application of missing security headers.
Affected products
- PrivateBin PrivateBin <= 2.0.4
Timeline
- 2026-07-11: disclosed
- 2026-08-28: patched: Fixed in version 2.0.5
References
- https://api.github.com/users/iaohkut-from-NightWolf-Team
- https://github.com/iaohkut-from-NightWolf-Team
- https://api.github.com/users/iaohkut-from-NightWolf-Team/gists%7B/gist_id%7D
- https://api.github.com/users/iaohkut-from-NightWolf-Team/repos
- https://avatars.githubusercontent.com/u/286391906?v=4
- https://api.github.com/users/iaohkut-from-NightWolf-Team/events%7B/privacy%7D