CVE-2026-61526

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-61526", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-10T16:27:03.092Z", "datePublished": "2026-07-30T20:55:43.406Z", "dateUpdated": "2026-07-31T19:20:48.817Z"}, "containers": {"cna": {"title": "AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6"}, {"name": "https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87", "tags": ["x_refsource_MISC"], "url": "https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87"}, {"name": "https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3", "tags": ["x_refsource_MISC"], "url": "https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3"}, {"name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.1"}, {"name": "https://github.com/adonisjs/http-server/releases/tag/v9.1.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/adonisjs/http-server/releases/tag/v9.1.0"}], "affected": [{"vendor": "adonisjs", "product": "http-server", "versions": [{"version": ">= 8.0.0-next.0, < 8.2.1", "status": "affected"}, {"version": ">= 9.0.0, < 9.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-30T20:55:43.406Z"}, "descriptions": [{"lang": "en", "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0."}], "source": {"advisory": "GHSA-cwm9-gfhc-46f6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-31T19:20:24.928162Z", "id": "CVE-2026-61526", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T19:20:48.817Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-61526", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T19:20:24.928162Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T19:20:40.244Z"}}], "cna": {"title": "AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler", "source": {"advisory": "GHSA-cwm9-gfhc-46f6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "adonisjs", "product": "http-server", "versions": [{"status": "affected", "version": ">= 8.0.0-next.0, < 8.2.1"}, {"status": "affected", "version": ">= 9.0.0, < 9.1.0"}]}], "references": [{"url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6", "name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87", "name": "https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3", "name": "https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.1", "name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/adonisjs/http-server/releases/tag/v9.1.0", "name": "https://github.com/adonisjs/http-server/releases/tag/v9.1.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-30T20:55:43.406Z"}}}, "cveMetadata": {"cveId": "CVE-2026-61526", "state": "PUBLISHED", "dateUpdated": "2026-07-31T19:20:48.817Z", "dateReserved": "2026-07-10T16:27:03.092Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-30T20:55:43.406Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "http-server", "vendor": "adonisjs", "versions": [{"status": "affected", "version": ">= 8.0.0-next.0, < 8.2.1"}, {"status": "affected", "version": ">= 9.0.0, < 9.1.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0."}, {"lang": "es", "value": "AdonisJS HTTP Server es un paquete para manejar solicitudes HTTP en el framework AdonisJS. En las versiones 8.0.0-next.0 a 8.2.0 y 9.0.0 a 9.0.2, el error.message se interpola en la respuesta de excepci\u00f3n HTML predeterminada sin escapar, permitiendo que una URL de ruta faltante manipulada ejecute JavaScript controlado por el atacante cuando una v\u00edctima la abre y ninguna p\u00e1gina de estado personalizada o respuesta JSON maneja el error. Cuando el modo de depuraci\u00f3n est\u00e1 deshabilitado y ninguna p\u00e1gina de estado personalizada maneja el error, el renderizador HTML predeterminado interpola error.message directamente en una respuesta HTML. Este problema est\u00e1 solucionado en las versiones 8.2.1 y 9.1.0."}], "id": "CVE-2026-61526", "lastModified": "2026-10-23T22:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61526", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-31T19:20:24.928162Z", "version": "2.0.3"}}]}, "published": "2026-07-30T21:18:12.030", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87"}, {"source": "security-advisories@github.com", "url": "https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3"}, {"source": "security-advisories@github.com", "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/adonisjs/http-server/releases/tag/v9.1.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0-next.0,8.2.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "http-server", "source": "cna", "vendor": "adonisjs"}, "product": "http-server", "vendor": "adonisjs"}], "created": "2026-07-30T22:30:06.334377+00:00", "updated": "2026-08-04T23:00:15.037516+00:00", "vendors": ["adonisjs", "adonisjs$PRODUCT$http-server"]}