CVE-2026-42192

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42192", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-25T01:53:21.583Z", "datePublished": "2026-05-08T21:13:25.159Z", "dateUpdated": "2026-05-12T02:06:42.303Z"}, "containers": {"cna": {"title": "Plunk: Stored XSS in campaign view", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/useplunk/plunk/security/advisories/GHSA-mjqc-qrv3-24hq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/useplunk/plunk/security/advisories/GHSA-mjqc-qrv3-24hq"}, {"name": "https://github.com/useplunk/plunk/releases/tag/v0.9.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/useplunk/plunk/releases/tag/v0.9.0"}], "affected": [{"vendor": "useplunk", "product": "plunk", "versions": [{"version": "< 0.9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T21:13:25.159Z"}, "descriptions": [{"lang": "en", "value": "Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cross-site scripting (XSS) vulnerability exists in the campaign management feature, where the email body content created by authenticated project members is stored and later rendered in the admin dashboard using React's dangerouslySetInnerHTML without any HTML sanitization. This allows a lower-privileged member to embed malicious scripts in a campaign's email body that execute in the context of any admin or other member who views the campaign, potentially enabling session hijacking or unauthorized actions on their behalf. This issue has been patched in version 0.9.0."}], "source": {"advisory": "GHSA-mjqc-qrv3-24hq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-12T02:06:32.646585Z", "id": "CVE-2026-42192", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T02:06:42.303Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42192", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T02:06:32.646585Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T02:06:38.000Z"}}], "cna": {"title": "Plunk: Stored XSS in campaign view", "source": {"advisory": "GHSA-mjqc-qrv3-24hq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "useplunk", "product": "plunk", "versions": [{"status": "affected", "version": "< 0.9.0"}]}], "references": [{"url": "https://github.com/useplunk/plunk/security/advisories/GHSA-mjqc-qrv3-24hq", "name": "https://github.com/useplunk/plunk/security/advisories/GHSA-mjqc-qrv3-24hq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/useplunk/plunk/releases/tag/v0.9.0", "name": "https://github.com/useplunk/plunk/releases/tag/v0.9.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cross-site scripting (XSS) vulnerability exists in the campaign management feature, where the email body content created by authenticated project members is stored and later rendered in the admin dashboard using React's dangerouslySetInnerHTML without any HTML sanitization. This allows a lower-privileged member to embed malicious scripts in a campaign's email body that execute in the context of any admin or other member who views the campaign, potentially enabling session hijacking or unauthorized actions on their behalf. This issue has been patched in version 0.9.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T21:13:25.159Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42192", "state": "PUBLISHED", "dateUpdated": "2026-05-12T02:06:42.303Z", "dateReserved": "2026-04-25T01:53:21.583Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T21:13:25.159Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "plunk", "vendor": "useplunk", "versions": [{"status": "affected", "version": "< 0.9.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cross-site scripting (XSS) vulnerability exists in the campaign management feature, where the email body content created by authenticated project members is stored and later rendered in the admin dashboard using React's dangerouslySetInnerHTML without any HTML sanitization. This allows a lower-privileged member to embed malicious scripts in a campaign's email body that execute in the context of any admin or other member who views the campaign, potentially enabling session hijacking or unauthorized actions on their behalf. This issue has been patched in version 0.9.0."}, {"lang": "es", "value": "Plunk es una plataforma de correo electr\u00f3nico de c\u00f3digo abierto construida sobre AWS SES. Antes de la versi\u00f3n 0.9.0, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en la funci\u00f3n de gesti\u00f3n de campa\u00f1as, donde el contenido del cuerpo del correo electr\u00f3nico creado por miembros autenticados del proyecto se almacena y luego se renderiza en el panel de administraci\u00f3n usando dangerouslySetInnerHTML de React sin ninguna sanitizaci\u00f3n HTML. Esto permite a un miembro con privilegios inferiores incrustar scripts maliciosos en el cuerpo del correo electr\u00f3nico de una campa\u00f1a que se ejecutan en el contexto de cualquier administrador u otro miembro que vea la campa\u00f1a, lo que podr\u00eda permitir el secuestro de sesi\u00f3n o acciones no autorizadas en su nombre. Este problema ha sido parcheado en la versi\u00f3n 0.9.0."}], "id": "CVE-2026-42192", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42192", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-12T02:06:32.646585Z", "version": "2.0.3"}}]}, "published": "2026-05-08T22:16:31.133", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/useplunk/plunk/releases/tag/v0.9.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/useplunk/plunk/security/advisories/GHSA-mjqc-qrv3-24hq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.9.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "plunk", "source": "cna", "vendor": "useplunk"}, "product": "plunk", "vendor": "useplunk"}], "created": "2026-05-08T22:30:18.334099+00:00", "updated": "2026-05-08T23:00:15.750910+00:00", "vendors": ["useplunk", "useplunk$PRODUCT$plunk"]}