Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 26 January 2026.

Which products and versions are affected?

@saltcorn/server (npm) SEMVER:introduced=1.1.1,fixed=1.5.0-beta.19; Saltcorn 1.1.1 through 1.4.1.

Is there a fix for This vulnerability?

Yes. @saltcorn/server (npm): upgrade to 1.5.0-beta.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run @saltcorn/server (npm) or Saltcorn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Saltcorn reflected XSS and command injection chaining for RCE

Severity: low · CVSS 3.1 · Published 2026-01-26

Saltcorn is an open-source low-code application builder. Two security flaws in Saltcorn can be chained together to allow an attacker to execute arbitrary commands on the server with just one click: if an administrator visits a malicious link while logged in, the attacker gains the ability to run any operating system command on the server where Saltcorn runs, compromising all data and system integrity.

Technologies: @saltcorn/server (npm), Saltcorn. Vendors: npm, Saltcorn.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 26 January 2026.
Which products and versions are affected?: @saltcorn/server (npm) SEMVER:introduced=1.1.1,fixed=1.5.0-beta.19; Saltcorn 1.1.1 through 1.4.1.
Is there a fix for This vulnerability?: Yes. @saltcorn/server (npm): upgrade to 1.5.0-beta.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run @saltcorn/server (npm) or Saltcorn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@saltcorn/server (npm): upgrade to 1.5.0-beta.19 or later
```
npm install @saltcorn/server@1.5.0-beta.19
```

Technical details

The vulnerability comprises two chained flaws: (1) a reflected XSS in the GET /admin/edit-codepage/:name endpoint where the "name" parameter is inserted into breadcrumbs without HTML sanitization (affecting versions ≥1.1.1), and (2) a command injection in GET /admin/backup where a backup password parameter is unsafely embedded into a shell command via string interpolation (affecting versions ≥1.3.0). An attacker can craft a specially-crafted link that, when clicked by an authenticated admin, executes arbitrary shell commands via the backup function. The attack requires user interaction (clicking a link) and an active admin session, but no special privileges or authentication. The vulnerability affects Saltcorn versions from 1.1.1 through 1.4.1 and was fixed in version 1.5.0-beta.19 via commit 1bf681e, which implements proper output encoding and replaces unsafe exec() calls with spawn().

Affected products

Saltcorn Saltcorn 1.1.1 through 1.4.1

Timeline

2026-01-26: disclosed
2026-01-13: patched: Fix committed; patched versions >= 1.5.0-beta.19

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.