CVE-2026-1520

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1520", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-01-28T10:08:12.406Z", "datePublished": "2026-01-28T14:32:06.745Z", "dateUpdated": "2026-02-23T09:00:04.097Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:00:04.097Z"}, "title": "rethinkdb Secondary Index cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "n/a", "product": "rethinkdb", "versions": [{"version": "2.4.0", "status": "affected"}, {"version": "2.4.1", "status": "affected"}, {"version": "2.4.2", "status": "affected"}, {"version": "2.4.3", "status": "affected"}], "modules": ["Secondary Index Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in rethinkdb up to 2.4.3. Affected by this issue is some unknown functionality of the component Secondary Index Handler. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-01-28T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-01-28T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-01-29T07:24:28.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "59lab (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.343191", "name": "VDB-343191 | rethinkdb Secondary Index cross site scripting", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.343191", "name": "VDB-343191 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.738312", "name": "Submit #738312 | rethinkdb V2.4.3(latest) cross-site scripting(XSS)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20rethinkdb%20database.md", "tags": ["related"]}, {"url": "https://github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20rethinkdb%20database.md#poc", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T16:27:25.234899Z", "id": "CVE-2026-1520", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T16:27:37.061Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1520", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T16:27:25.234899Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T16:27:33.691Z"}}], "cna": {"title": "rethinkdb Secondary Index cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "59lab (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "n/a", "modules": ["Secondary Index Handler"], "product": "rethinkdb", "versions": [{"status": "affected", "version": "2.4.0"}, {"status": "affected", "version": "2.4.1"}, {"status": "affected", "version": "2.4.2"}, {"status": "affected", "version": "2.4.3"}]}], "timeline": [{"lang": "en", "time": "2026-01-28T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-01-28T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-01-29T07:24:28.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.343191", "name": "VDB-343191 | rethinkdb Secondary Index cross site scripting", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.343191", "name": "VDB-343191 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.738312", "name": "Submit #738312 | rethinkdb V2.4.3(latest) cross-site scripting(XSS)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20rethinkdb%20database.md", "tags": ["related"]}, {"url": "https://github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20rethinkdb%20database.md#poc", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in rethinkdb up to 2.4.3. Affected by this issue is some unknown functionality of the component Secondary Index Handler. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:00:04.097Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1520", "state": "PUBLISHED", "dateUpdated": "2026-02-23T09:00:04.097Z", "dateReserved": "2026-01-28T10:08:12.406Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-01-28T14:32:06.745Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Secondary Index Handler"], "product": "rethinkdb", "vendor": "n/a", "versions": [{"status": "affected", "version": "2.4.0"}, {"status": "affected", "version": "2.4.1"}, {"status": "affected", "version": "2.4.2"}, {"status": "affected", "version": "2.4.3"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in rethinkdb up to 2.4.3. Affected by this issue is some unknown functionality of the component Secondary Index Handler. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una vulnerabilidad fue identificada en rethinkdb hasta 2.4.3. Afectada por este problema es alguna funcionalidad desconocida del componente Secondary Index Handler. Dicha manipulaci\u00f3n conduce a cross-site scripting. Es posible lanzar el ataque de forma remota. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. El proveedor fue contactado con antelaci\u00f3n sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-1520", "lastModified": "2026-06-17T10:15:59.273", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1520", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T16:27:25.234899Z", "version": "2.0.3"}}]}, "published": "2026-01-28T15:16:17.303", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20rethinkdb%20database.md"}, {"source": "cna@vuldb.com", "url": "https://github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20rethinkdb%20database.md#poc"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.343191"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.343191"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.738312"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T14:41:41.486576+00:00", "value": {"mitigation_remediation": ["Upgrade RethinkDB to a version newer than 2.4.3 when it becomes available.", "If an upgrade is not feasible, disable secondary index functionality or restrict access to the database server from trusted hosts only.", "Implement output sanitization or a web application firewall to mitigate script injection that may originate from secondary index data."], "summary": {"action": "Assess", "impact": "Cross-Site Scripting"}, "threat_synthesis": {"affected_systems": "All deployments of RethinkDB versions 2.4.3 and earlier are impacted. The flaw resides in the component that handles secondary index operations and therefore affects any installation that uses secondary indexes. No specific operating system or environment constraints are provided, so the risk applies broadly to all supported platforms for those product versions.", "description_and_impact": "The identified flaw is a cross\u2011site scripting vulnerability within the Secondary Index Handler of RethinkDB. Manipulation of the index metadata allows an attacker to inject arbitrary script code that is then returned to users who retrieve the affected metadata. The vulnerability can lead to the execution of malicious scripts in the browsers of legitimate users, potentially compromising the confidentiality and integrity of data transmitted by those browsers. This weakness is classified as CWE-79 and CWE-94.", "risk_and_exploitability": "The CVSS score of 4.8 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation has not been widely observed. A publicly available proof\u2011of\u2011concept demonstrates that the attack can be carried out remotely without authentication. Although the vulnerability is not currently listed in the CISA KEV catalog, the presence of a remote exploit and the lack of an official patch mean that deployments should be monitored, and remediation should be prioritized if a fix becomes available."}}}}, "created": "2026-01-29T09:09:26.338086+00:00", "updated": "2026-04-18T14:45:03.149021+00:00", "vendors": ["rethinkdb", "rethinkdb$PRODUCT$rethinkdb"]}