{"id":"CVE-2026-117182","kind":"vulnerability","aliases":["CVE-2026-117182"],"related":[],"title":"Spina CMS: authenticated XSS in embeddable.rb lets attackers run scripts","description":"An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted URL.","summary":"Spina CMS v2.21.0 has a cross-site scripting flaw in its /spina/embeddable.rb component. An attacker who has a login can inject a crafted URL to run arbitrary scripts or HTML in another user's browser.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","rails","ruby","self-hosted","spina"],"not_affected_if":["other-version","unauthenticated-only-access"],"how_to_check":"- Confirm the Spina CMS version with `bundle exec rails runner \"puts Spina::VERSION\"` or by checking the Gemfile.lock for `spina`\n- If the version is `2.21.0`, the install is in the affected range","fix":null,"status":"open","published_at":"2026-10-30T16:17:41+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","triaged_at":"2026-10-30T16:32:37+00:00","updated_at":"2026-10-30T16:32:37+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T16:32:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Spina CMS: authenticated XSS in embeddable.rb lets attackers run scripts","impact":"medium","summary":"Spina CMS v2.21.0 has a cross-site scripting flaw in its /spina/embeddable.rb component. An attacker who has a login can inject a crafted URL to run arbitrary scripts or HTML in another user's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["spina","ruby","rails","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs scripts in another user's admin session","analyst_note":"Check the NVD entry and the Spina CMS repository for a fixed version and whether a crafted URL needs a click.","how_to_check":"- Confirm the Spina CMS version with `bundle exec rails runner \"puts Spina::VERSION\"` or by checking the Gemfile.lock for `spina`\n- If the version is `2.21.0`, the install is in the affected range","plain_action":"","needs_analyst":true,"not_affected_if":["unauthenticated-only-access","other-version"],"who_is_affected":"Teams running Spina CMS v2.21.0 where users with editor accounts can reach the embeddable component. The sources do not say whether a fixed version exists. Installs on other versions, or without authenticated users, are less likely to be exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":4112,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117182':13A,16A '-2026':12A,15A '/spina/embeddable.rb':36B,70C 'allow':76C 'anoth':56B 'arbitrari':51B,80C 'attack':8A,39B,77C 'authent':3A,61C 'browser':59B 'cms':2A,25B,74C 'compon':37B,71C 'craft':47B,88C 'cross':30B,63C 'cross-sit':29B,62C 'cve':11A,14A 'embeddable.rb':6A 'execut':79C 'flaw':33B 'host':22B 'html':54B,84C 'inject':45B,86C 'let':7A 'login':43B 'packag':17B 'rail':18B 'rubi':19B 'run':9A,50B 'script':10A,32B,52B,65C,82C 'self':21B 'self-host':20B 'site':31B,64C 'spina':1A,23B,24B,73C 'url':48B,89C 'user':57B 'v2.21.0':26B,75C 'via':85C 'vulner':67C 'web':81C 'xss':4A,66C","nicknames":[],"mitigations":[],"who_affected":"Teams running Spina CMS v2.21.0 where users with editor accounts can reach the embeddable component. The sources do not say whether a fixed version exists. Installs on other versions, or without authenticated users, are less likely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117182","severity":null,"published_at":"2026-10-30T16:17:41+00:00","modified_at":"2026-10-30T16:17:41+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","fetched_at":"2026-10-30T16:31:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}