# CVE-2026-82664: yaojingang GEOFlow cross-site scripting in search

Source: https://junglewise.ai/threats/cve-2026-82664-yaojingang-geoflow-cross-site-scripting-in-search  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82664 · Severity: medium · CVSS 4.3 · Published 2026-08-31

GEOFlow is an open-source content management and distribution platform. A cross-site scripting (XSS) vulnerability in the search functionality allows remote attackers to inject malicious scripts that execute in users' browsers, potentially compromising user sessions, stealing credentials, or defacing content without requiring authentication.

Technologies: [Yaojingang GEOFlow](https://junglewise.ai/threats/technologies/geoflow). Vendors: [Yaojingang](https://junglewise.ai/threats/vendors/yaojingang).

## Quick answers

**Is CVE-2026-82664 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82664 being exploited in the wild.

**How severe is CVE-2026-82664?** Medium severity, with a CVSS score of 4.3, published 31 August 2026.

**Which products and versions are affected?** Yaojingang GEOFlow up to 2.1.0.

**Is there a fix for CVE-2026-82664?** A patch was published on 2026-07-17: Fix merged in commit 67abfd864a15d169a78429f3290c91cb3b93e849; patch available in version 2.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82664 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82664?** Check whether you run Yaojingang GEOFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in the JSON-LD Theme Handler component, specifically in app/Http/Controllers/Site/HomeController.php. The search parameter is not properly sanitized before being output to the page, allowing an attacker to craft a malicious URL containing JavaScript code. The attack is network-based and requires no authentication; a victim only needs to click a crafted link. An attacker can execute arbitrary JavaScript in the victim's browser context, potentially stealing session cookies or performing actions on their behalf. The vulnerability was patched in version 2.1.1 (commit 67abfd864a15d169a78429f3290c91cb3b93e849), and upgrading is recommended.

## Affected products

- yaojingang GEOFlow up to 2.1.0

## Timeline

- 2026-08-31: disclosed
- 2026-07-17: patched: Fix merged in commit 67abfd864a15d169a78429f3290c91cb3b93e849; patch available in version 2.1.1

## References

- [https://github.com/yaojingang/GEOFlow/](https://github.com/yaojingang/GEOFlow/)
- [https://github.com/yaojingang/GEOFlow/commit/67abfd864a15d169a78429f3290c91cb3b93e849](https://github.com/yaojingang/GEOFlow/commit/67abfd864a15d169a78429f3290c91cb3b93e849)

## Related threats

- [yaojingang GEOFlow server-side request forgery in endpoint validation](https://junglewise.ai/threats/cve-2026-82667-yaojingang-geoflow-server-side-request-forgery-in-endpoint)
- [yaojingang GEOFlow code injection in theme editor](https://junglewise.ai/threats/cve-2026-82666-yaojingang-geoflow-code-injection-in-theme-editor)
- [yaojingang GEOFlow path traversal in image library cleanup](https://junglewise.ai/threats/cve-2026-82665-yaojingang-geoflow-path-traversal-in-image-library-cleanup)