CVE-2026-108802

3.5Low

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

3.5Low

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79, CWE-94

Impact

Authenticated low-privileged attackers can execute arbitrary JavaScript in another user's browser if the victim views a manipulated dictionary preview. This requires network access, valid credentials, and user interaction.

Root cause

Improper input sanitization allows stored cross-site scripting via the cssClass parameter in the dictionary data drawer preview component.

Affected systems

y_project RuoYi up to 4.8.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Fix & remediation

No official patched version is available; restrict access to the /system/dict/data/add endpoint or sanitize the cssClass parameter in the renderDrawer function.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108802