Live › vulnerability › CVE-2026-117182
Spina CMS v2.21.0 has a cross-site scripting flaw in its /spina/embeddable.rb component. An attacker who has a login can inject a crafted URL to run arbitrary scripts or HTML in another user's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Teams running Spina CMS v2.21.0 where users with editor accounts can reach the embeddable component. The sources do not say whether a fixed version exists. Installs on other versions, or without authenticated users, are less likely to be exposed.
No product ranges from the sources yet.
bundle exec rails runner "puts Spina::VERSION" or by checking the Gemfile.lock for spina2.21.0, the install is in the affected rangeNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted URL.
This page as .md · .json · in your agent: get_signal("CVE-2026-117182")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.