rootpwn

high · CVSS v3 7.5 · CVSS v4 7.7

CVE-2026-92784

A cross-site scripting (XSS) vulnerability exists in @refinedev/inferencer versions up to 7.0.0 due to unescaped API field names during JSX

Overview

A cross-site scripting (XSS) vulnerability exists in @refinedev/inferencer versions up to 7.0.0 due to unescaped API field names during JSX source code generation. When an application renders the Inferencer component using data from a compromised or untrusted provider, malicious JavaScript embedded in JSON property names can execute in the victim's browser session.

Description

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders.

Impact

Developers and application users viewing Inferencer-generated interfaces are impacted. Successful exploitation affects confidentiality and integrity by allowing arbitrary script execution, potentially exposing session tokens, sensitive data, or enabling unauthorized actions within the browser.

Remediation

Upgrade @refinedev/inferencer to a patched version beyond 7.0.0 that properly escapes API field names. As an interim mitigation, restrict usage of the Inferencer component to trusted data providers and sanitize API schema metadata before client-side rendering.

Risk context

Assessed as High severity with a CVSS v3 score of 7.5 and CVSS v4 score of 7.7. EPSS score is currently unavailable. Urgency is moderate to high for teams using Inferencer components in development or production with untrusted backend sources.

Affected products

  • @refinedev/inferencer <= 7.0.0
  • Refine Framework

Scores

Severity
high
CVSS v2
7.6
CVSS v3
7.5
CVSS v4
7.7
EPSS
—

XSS JavaScript Refine npm Code Injection JSX

← All CVEs

Related CVEs

high

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 are vulnerable to a stack-based buffer overflow when parsing Affinity document files. An attacker can craft a malicious file that, when opened, may allow arbitrary code execution on the victim’s machine.

View analysis

high

CVE-2026-92838

A DLL hijacking flaw in GeoVision GV-Remote E-Map allows a local user with write access to a directory to drop a malicious DLL that is loaded before the legitimate one. If exploited, the attacker can run arbitrary code in the context of the GV-Remote E-Map process, potentially compromising local data and system integrity.

View analysis

high

CVE-2026-88765

A high‑severity buffer overflow in the Unicode conversion wrapper of certain Git hosting platforms allows an authenticated user to upload a crafted Git export file that triggers arbitrary remote code execution during Advanced Search indexing. The flaw can lead to full server compromise if exploited.

View analysis

high

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis