# Saltcorn reflected XSS and command injection chaining for RCE

Source: https://junglewise.ai/threats/saltcorn-reflected-xss-and-command-injection-chaining-for-rce-91ca3009  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-01-26

Saltcorn is an open-source low-code application builder. Two security flaws in Saltcorn can be chained together to allow an attacker to execute arbitrary commands on the server with just one click: if an administrator visits a malicious link while logged in, the attacker gains the ability to run any operating system command on the server where Saltcorn runs, compromising all data and system integrity.

Technologies: [@saltcorn/server (npm)](https://junglewise.ai/threats/technologies/saltcorn-server), [Saltcorn](https://junglewise.ai/threats/technologies/saltcorn). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Saltcorn](https://junglewise.ai/threats/vendors/saltcorn).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 26 January 2026.

**Which products and versions are affected?** @saltcorn/server (npm) SEMVER:introduced=1.1.1,fixed=1.5.0-beta.19; Saltcorn 1.1.1 through 1.4.1.

**Is there a fix for This vulnerability?** Yes. @saltcorn/server (npm): upgrade to 1.5.0-beta.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run @saltcorn/server (npm) or Saltcorn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @saltcorn/server (npm): upgrade to 1.5.0-beta.19 or later

  ```sh
  npm install @saltcorn/server@1.5.0-beta.19
  ```


## Technical details

The vulnerability comprises two chained flaws: (1) a reflected XSS in the GET /admin/edit-codepage/:name endpoint where the "name" parameter is inserted into breadcrumbs without HTML sanitization (affecting versions ≥1.1.1), and (2) a command injection in GET /admin/backup where a backup password parameter is unsafely embedded into a shell command via string interpolation (affecting versions ≥1.3.0). An attacker can craft a specially-crafted link that, when clicked by an authenticated admin, executes arbitrary shell commands via the backup function. The attack requires user interaction (clicking a link) and an active admin session, but no special privileges or authentication. The vulnerability affects Saltcorn versions from 1.1.1 through 1.4.1 and was fixed in version 1.5.0-beta.19 via commit 1bf681e, which implements proper output encoding and replaces unsafe exec() calls with spawn().

## Affected products

- Saltcorn Saltcorn 1.1.1 through 1.4.1

## Timeline

- 2026-01-26: disclosed
- 2026-01-13: patched: Fix committed; patched versions >= 1.5.0-beta.19

## References

- [https://github.com/saltcorn/saltcorn/security/advisories/GHSA-cr3w-cw5w-h3fj](https://github.com/saltcorn/saltcorn/security/advisories/GHSA-cr3w-cw5w-h3fj)
- [https://github.com/saltcorn/saltcorn/commit/1bf681e08c45719a52afcf3506fb5ec59f4974d5](https://github.com/saltcorn/saltcorn/commit/1bf681e08c45719a52afcf3506fb5ec59f4974d5)

## Related threats

- [Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)](https://junglewise.ai/threats/cve-2026-41478-saltcorn-sql-injection-via-unparameterized-sync-endpoints)
- [Saltcorn open redirect in login via backslash bypass](https://junglewise.ai/threats/cve-2026-42259-saltcorn-open-redirect-in-login-via-backslash-bypass)
- [Saltcorn @saltcorn/data SQL injection in jsexprToSQL Literal Handler](https://junglewise.ai/threats/saltcorn-saltcorn-data-sql-injection-in-jsexprtosql-literal-handler-bdaf86bc)
- [Saltcorn path traversal in mobile sync endpoints](https://junglewise.ai/threats/cve-2026-40163-saltcorn-path-traversal-in-mobile-sync-endpoints)
- [Saltcorn Server stored XSS in event logs page](https://junglewise.ai/threats/saltcorn-server-stored-xss-in-event-logs-page-29714f98)