XSS in Dumbwareio Dumbassets
CVE-2026-45231
DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, description, modelNumber, serialNumber, and tags that are stored without server-side sanitization and rendered using innerHTML without client-side escaping. Attackers can create or update assets with HTML or JavaScript payloads via the asset API endpoints to execute arbitrary scripts in the browsers of users viewing the asset list, and with Content-Security-Policy disabled, the injected scripts can make unrestricted connections to internal network services.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (21.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 21.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
- Dumbwareio Dumbassets — versions 0
Weakness classification (CWE)
References
- github.com/DumbWareio/DumbAssets/pull/135 (issue-tracking, patch)
- www.vulncheck.com/advisories/dumbassets-stored-cross-site-scripting-via-asset-f… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-45231?
- CVE-2026-45231 is a medium-severity vulnerability in Dumbwareio Dumbassets, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-05-18.
- How severe is CVE-2026-45231?
- Medium severity. CVSS v3 base score is 6.1 out of 10.