CVE-2026-27639

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27639", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T22:02:30.029Z", "datePublished": "2026-02-25T03:44:26.241Z", "dateUpdated": "2026-02-25T15:20:41.753Z"}, "containers": {"cna": {"title": "Mercator vulnerable to stored XSS via unescaped Blade directives in display templates", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/dbarzin/mercator/security/advisories/GHSA-65p7-pph2-966g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dbarzin/mercator/security/advisories/GHSA-65p7-pph2-966g"}, {"name": "https://github.com/dbarzin/mercator/commit/839d231399944e43a865198262e96e0218252cc3", "tags": ["x_refsource_MISC"], "url": "https://github.com/dbarzin/mercator/commit/839d231399944e43a865198262e96e0218252cc3"}, {"name": "https://github.com/dbarzin/mercator/commit/9902ffd91f287e474729f514c77261f4ef7db8fe", "tags": ["x_refsource_MISC"], "url": "https://github.com/dbarzin/mercator/commit/9902ffd91f287e474729f514c77261f4ef7db8fe"}, {"name": "https://github.com/dbarzin/mercator/commit/c58bb1d2fff18605c61d93cfaf77adca416c560a", "tags": ["x_refsource_MISC"], "url": "https://github.com/dbarzin/mercator/commit/c58bb1d2fff18605c61d93cfaf77adca416c560a"}], "affected": [{"vendor": "dbarzin", "product": "mercator", "versions": [{"version": "< 2026.02.22", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T03:44:26.241Z"}, "descriptions": [{"lang": "en", "value": "Mercator is an open source web application designed to enable mapping of information systems. A stored Cross-Site Scripting (XSS) vulnerability exists in Mercator prior to version 2026.02.22 due to the use of unescaped Blade directives (`{!! !!}`) in display templates. An authenticated user with the User role can inject arbitrary JavaScript payloads into fields such as \"contact point\" when creating or editing entities. The payload is then executed in the browser of any user who views the affected page, including administrators. Version 2026.02.22 fixes the vulnerability."}], "source": {"advisory": "GHSA-65p7-pph2-966g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T15:20:28.655665Z", "id": "CVE-2026-27639", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:20:41.753Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27639", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-25T15:20:28.655665Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:20:33.672Z"}}], "cna": {"title": "Mercator vulnerable to stored XSS via unescaped Blade directives in display templates", "source": {"advisory": "GHSA-65p7-pph2-966g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "dbarzin", "product": "mercator", "versions": [{"status": "affected", "version": "< 2026.02.22"}]}], "references": [{"url": "https://github.com/dbarzin/mercator/security/advisories/GHSA-65p7-pph2-966g", "name": "https://github.com/dbarzin/mercator/security/advisories/GHSA-65p7-pph2-966g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/dbarzin/mercator/commit/839d231399944e43a865198262e96e0218252cc3", "name": "https://github.com/dbarzin/mercator/commit/839d231399944e43a865198262e96e0218252cc3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/dbarzin/mercator/commit/9902ffd91f287e474729f514c77261f4ef7db8fe", "name": "https://github.com/dbarzin/mercator/commit/9902ffd91f287e474729f514c77261f4ef7db8fe", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/dbarzin/mercator/commit/c58bb1d2fff18605c61d93cfaf77adca416c560a", "name": "https://github.com/dbarzin/mercator/commit/c58bb1d2fff18605c61d93cfaf77adca416c560a", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mercator is an open source web application designed to enable mapping of information systems. A stored Cross-Site Scripting (XSS) vulnerability exists in Mercator prior to version 2026.02.22 due to the use of unescaped Blade directives (`{!! !!}`) in display templates. An authenticated user with the User role can inject arbitrary JavaScript payloads into fields such as \"contact point\" when creating or editing entities. The payload is then executed in the browser of any user who views the affected page, including administrators. Version 2026.02.22 fixes the vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T03:44:26.241Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27639", "state": "PUBLISHED", "dateUpdated": "2026-02-25T15:20:41.753Z", "dateReserved": "2026-02-20T22:02:30.029Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T03:44:26.241Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mercator", "vendor": "dbarzin", "versions": [{"status": "affected", "version": "< 2026.02.22"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sourcentis:mercator:*:*:*:*:*:*:*:*", "matchCriteriaId": "CEB2FD8C-B4C4-41DE-B882-FDF1DCDD114F", "versionEndExcluding": "2026.02.22", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mercator is an open source web application designed to enable mapping of information systems. A stored Cross-Site Scripting (XSS) vulnerability exists in Mercator prior to version 2026.02.22 due to the use of unescaped Blade directives (`{!! !!}`) in display templates. An authenticated user with the User role can inject arbitrary JavaScript payloads into fields such as \"contact point\" when creating or editing entities. The payload is then executed in the browser of any user who views the affected page, including administrators. Version 2026.02.22 fixes the vulnerability."}, {"lang": "es", "value": "Mercator es una aplicaci\u00f3n web de c\u00f3digo abierto dise\u00f1ada para permitir el mapeo de sistemas de informaci\u00f3n. Una vulnerabilidad de cross-site scripting (XSS) almacenado existe en Mercator antes de la versi\u00f3n 2026.02.22 debido al uso de directivas Blade sin escapar ('{!! !!}') en las plantillas de visualizaci\u00f3n. Un usuario autenticado con el rol de usuario puede inyectar cargas \u00fatiles de JavaScript arbitrarias en campos como 'punto de contacto' al crear o editar entidades. La carga \u00fatil se ejecuta entonces en el navegador de cualquier usuario que vea la p\u00e1gina afectada, incluidos los administradores. La versi\u00f3n 2026.02.22 corrige la vulnerabilidad."}], "id": "CVE-2026-27639", "lastModified": "2026-06-17T10:27:26.323", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27639", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T15:20:28.655665Z", "version": "2.0.3"}}]}, "published": "2026-02-25T04:16:04.280", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/dbarzin/mercator/commit/839d231399944e43a865198262e96e0218252cc3"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/dbarzin/mercator/commit/9902ffd91f287e474729f514c77261f4ef7db8fe"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/dbarzin/mercator/commit/c58bb1d2fff18605c61d93cfaf77adca416c560a"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/dbarzin/mercator/security/advisories/GHSA-65p7-pph2-966g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2026.02.22)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mercator", "source": "cna", "vendor": "dbarzin"}, "product": "mercator", "vendor": "dbarzin"}], "analysis": {"en": {"generated_at": "2026-04-17T15:27:28.989666+00:00", "value": {"mitigation_remediation": ["Upgrade Mercator to version 2026.02.22 or later, which removes the unescaped Blade directives from all display templates.", "After the upgrade, inspect the templates and configuration to confirm that no remaining use of ``{!! !!}`` exists, and enforce strict output escaping of all user\u2011supplied data.", "Clean any stored payloads from existing entities by removing suspicious content from fields such as the contact point.", "Conduct a code review or automated scan to identify any other potential unescaped Blade usage throughout the application."], "summary": {"action": "Apply Patch", "impact": "Stored XSS"}, "threat_synthesis": {"affected_systems": "The affected product is Mercator, released by dbarzin. All versions prior to 2026.02.22 contain the flaw; version 2026.02.22 and later contain the fix. No specific vendor product names beyond \"Mercator\" are listed.", "description_and_impact": "Mercator is an open\u2011source mapping application that allows authenticated users to create and edit system entities. The vulnerability arises from the use of unescaped Blade directives (``{!! !!}``) in the display templates, which means that any JavaScript injected into a field such as \"contact point\" is rendered directly into the page without filtering. When an entity containing such a payload is viewed, the script runs in the browser of any user who opens the page, including administrators. This can lead to cookie theft, session hijacking, data exfiltration, or other malicious actions that compromise confidentiality and integrity. The weakness is classified as CWE\u201179: Cross\u2011Site Scripting.", "risk_and_exploitability": "The CVSS base score of 8.5 indicates a high severity vulnerability. The EPSS score of less than 1% suggests current exploitation probability is low, and the issue is not yet listed in the CISA KEV catalog. The attack vector is inferred to be malware injection by an authenticated user with the User role; this user can add malicious code to entities, which then propagates to every user who views the affected page. The high score and broad reach within the user community mean that this vulnerability poses a significant risk to affected deployments, especially where privileged users can create or edit entities."}}}}, "created": "2026-02-25T11:34:44.135623+00:00", "updated": "2026-04-17T15:30:06.036412+00:00", "vendors": ["dbarzin", "dbarzin$PRODUCT$mercator"]}