CVE-2026-129141 · Runtime
NO FIX YET
paicoding 1.0.0 through 1.0.3 writes user profile text unescaped into an inline JSON-LD script element, so a closing script tag in a profile breaks out of the data. An authenticated user can run scripts in the browsers of people who view their profile and read the non-HttpOnly f-session cookie.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running paicoding 1.0.0 through 1.0.3 where users can edit profile text that is rendered on public profile pages. Attackers need a registered account, and the flaw is in the profile page rendering, so sites without public profiles or with a different version can skip it.
Not affected if no-public-profiles, version-outside-1.0.0-1.0.3
Who cares java, paicoding, self-hosted
1.0.0 through 1.0.3 are affected.No fix yet, per the sources.
paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user profile text without escaping in an inline JSON-LD script element. Authenticated attackers can add a closing script tag followed by HTML to their profile, executing scripts for visitors of their profile page and stealing the non-HttpOnly f-session cookie.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.