CVE-2026-25144

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25144", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-29T15:39:11.821Z", "datePublished": "2026-02-02T22:54:58.110Z", "dateUpdated": "2026-02-04T16:52:59.188Z"}, "containers": {"cna": {"title": "Talishar has a Stored XSS which can lead to data exfiltration & user impersonation", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Talishar/Talishar/security/advisories/GHSA-rrr4-h2pc-57g6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Talishar/Talishar/security/advisories/GHSA-rrr4-h2pc-57g6"}, {"name": "https://github.com/Talishar/Talishar/commit/09dd00e5452e3cd998eb1406a88e5b0fa868e6b4", "tags": ["x_refsource_MISC"], "url": "https://github.com/Talishar/Talishar/commit/09dd00e5452e3cd998eb1406a88e5b0fa868e6b4"}], "affected": [{"vendor": "Talishar", "product": "Talishar", "versions": [{"version": "< 09dd00e5452e3cd998eb1406a88e5b0fa868e6b4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-02T22:54:58.110Z"}, "descriptions": [{"lang": "en", "value": "Talishar is a fan-made Flesh and Blood project. A Stored XSS exists in the chat in-game system. The playerID parameter in SubmitChat.php and is saved without sanitization and executed whenever a user view the current page game. This vulnerability is fixed by 09dd00e5452e3cd998eb1406a88e5b0fa868e6b4."}], "source": {"advisory": "GHSA-rrr4-h2pc-57g6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T15:55:16.054941Z", "id": "CVE-2026-25144", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:52:59.188Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25144", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T15:55:16.054941Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T15:55:16.950Z"}}], "cna": {"title": "Talishar has a Stored XSS which can lead to data exfiltration & user impersonation", "source": {"advisory": "GHSA-rrr4-h2pc-57g6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Talishar", "product": "Talishar", "versions": [{"status": "affected", "version": "< 09dd00e5452e3cd998eb1406a88e5b0fa868e6b4"}]}], "references": [{"url": "https://github.com/Talishar/Talishar/security/advisories/GHSA-rrr4-h2pc-57g6", "name": "https://github.com/Talishar/Talishar/security/advisories/GHSA-rrr4-h2pc-57g6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Talishar/Talishar/commit/09dd00e5452e3cd998eb1406a88e5b0fa868e6b4", "name": "https://github.com/Talishar/Talishar/commit/09dd00e5452e3cd998eb1406a88e5b0fa868e6b4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Talishar is a fan-made Flesh and Blood project. A Stored XSS exists in the chat in-game system. The playerID parameter in SubmitChat.php and is saved without sanitization and executed whenever a user view the current page game. This vulnerability is fixed by 09dd00e5452e3cd998eb1406a88e5b0fa868e6b4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-02T22:54:58.110Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25144", "state": "PUBLISHED", "dateUpdated": "2026-02-04T16:52:59.188Z", "dateReserved": "2026-01-29T15:39:11.821Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-02T22:54:58.110Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Talishar", "vendor": "Talishar", "versions": [{"status": "affected", "version": "< 09dd00e5452e3cd998eb1406a88e5b0fa868e6b4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Talishar is a fan-made Flesh and Blood project. A Stored XSS exists in the chat in-game system. The playerID parameter in SubmitChat.php and is saved without sanitization and executed whenever a user view the current page game. This vulnerability is fixed by 09dd00e5452e3cd998eb1406a88e5b0fa868e6b4."}, {"lang": "es", "value": "Talishar es un proyecto de Flesh and Blood creado por fans. Existe una XSS Almacenada en el sistema de chat del juego. El par\u00e1metro playerID en SubmitChat.PHP se guarda sin sanitizaci\u00f3n y se ejecuta cada vez que un usuario ve la p\u00e1gina actual del juego. Esta vulnerabilidad se corrige con 09dd00e5452e3cd998eb1406a88e5b0fa868e6b4."}], "id": "CVE-2026-25144", "lastModified": "2026-06-17T10:24:11.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25144", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T15:55:16.054941Z", "version": "2.0.3"}}]}, "published": "2026-02-02T23:16:09.600", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Talishar/Talishar/commit/09dd00e5452e3cd998eb1406a88e5b0fa868e6b4"}, {"source": "security-advisories@github.com", "url": "https://github.com/Talishar/Talishar/security/advisories/GHSA-rrr4-h2pc-57g6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:28:56.407069+00:00", "value": {"mitigation_remediation": ["Apply the patch corresponding to commit 09dd00e5452e3cd998eb1406a88e5b0fa868e6b4 to the Talishar codebase.", "Remove the playerID parameter from being executed as script or enforce strict input validation before storage and rendering.", "Implement server\u2011side sanitization for all chat inputs to prevent injection of executable code."], "summary": {"action": "Apply patch", "impact": "Cross\u2011Site Scripting enabling data exfiltration and user impersonation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Talishar application developed by Talishar. All game builds that include the unpatched SubmitChat.php code are impacted; the issue is resolved in the commit 09dd00e5452e3cd998eb1406a88e5b0fa868e6b4.", "description_and_impact": "A Stored XSS vulnerability exists in Talishar\u2019s in\u2011game chat system. The playerID parameter in SubmitChat.php is stored without sanitization and later executed whenever a user views the current page. This flaw can be exploited to inject malicious scripts that run in the context of other players, allowing data exfiltration and user impersonation. The weakness corresponds to CWE\u201179.", "risk_and_exploitability": "The CVSS base score is 5.3, indicating moderate risk. The EPSS score is less than 1%, suggesting a very low probability of exploitation at present. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitability requires a user with access to the in\u2011game chat to submit a crafted playerID parameter, resulting in script execution for anyone who later views the chat."}}}}, "created": "2026-02-04T12:17:41.375419+00:00", "updated": "2026-04-18T00:30:25.718928+00:00", "vendors": ["talishar", "talishar$PRODUCT$talishar"]}