Live › vulnerability › CVE-2026-112039
Go to dashboardThe diem project's administrative console appends the dm_command argument to output without escaping it, so a crafted link can run script in a logged-in admin's browser. The exploit is public, and the project has not responded to the report.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the diem project's administrative console, which is the dmConsole module in dmAdminPlugin. The sources do not say which deployments enable it by default. Teams that do not run diem can skip this.
No product ranges from the sources yet.
dmAdminPlugin in the project tree.116974edfb9a5b8bd69cb13586dc62bcdbb485ad; the sources say the project is a rolling release with no version numbers.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. The manipulation of the argument dm_command results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112039")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.