Quick answers
- Is CVE-2026-82664 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82664 being exploited in the wild.
- How severe is CVE-2026-82664?
- Medium severity, with a CVSS score of 4.3, published 31 August 2026.
- Which products and versions are affected?
- Yaojingang GEOFlow up to 2.1.0.
- Is there a fix for CVE-2026-82664?
- A patch was published on 2026-07-17: Fix merged in commit 67abfd864a15d169a78429f3290c91cb3b93e849; patch available in version 2.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82664 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-82664?
- Check whether you run Yaojingang GEOFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the JSON-LD Theme Handler component, specifically in app/Http/Controllers/Site/HomeController.php. The search parameter is not properly sanitized before being output to the page, allowing an attacker to craft a malicious URL containing JavaScript code. The attack is network-based and requires no authentication; a victim only needs to click a crafted link. An attacker can execute arbitrary JavaScript in the victim's browser context, potentially stealing session cookies or performing actions on their behalf. The vulnerability was patched in version 2.1.1 (commit 67abfd864a15d169a78429f3290c91cb3b93e849), and upgrading is recommended.
Affected products
- yaojingang GEOFlow up to 2.1.0
Timeline
- 2026-08-31: disclosed
- 2026-07-17: patched: Fix merged in commit 67abfd864a15d169a78429f3290c91cb3b93e849; patch available in version 2.1.1