{"id":"CVE-2026-129141","kind":"vulnerability","aliases":["CVE-2026-129141"],"related":[],"title":"paicoding: profile text lets logged-in users run scripts for visitors","description":"paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user profile text without escaping in an inline JSON-LD script element. Authenticated attackers can add a closing script tag followed by HTML to their profile, executing scripts for visitors of their profile page and stealing the non-HttpOnly f-session cookie.","summary":"paicoding 1.0.0 through 1.0.3 writes user profile text unescaped into an inline JSON-LD script element, so a closing script tag in a profile breaks out of the data. An authenticated user can run scripts in the browsers of people who view their profile and read the non-HttpOnly f-session cookie.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","paicoding","runtime","self-hosted"],"not_affected_if":["no-public-profiles","version-outside-1.0.0-1.0.3"],"how_to_check":"- Check the paicoding version in the deployed project's pom.xml or release tag, `1.0.0` through `1.0.3` are affected.\n- Look for the SeoInjectService class and its JSON-LD output on profile pages.","fix":null,"status":"open","published_at":"2026-11-13T18:17:38+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","triaged_at":"2026-11-13T18:51:58+00:00","updated_at":"2026-11-13T18:51:58+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T18:51:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"paicoding: profile text lets logged-in users run scripts for visitors","impact":"medium","summary":"paicoding 1.0.0 through 1.0.3 writes user profile text unescaped into an inline JSON-LD script element, so a closing script tag in a profile breaks out of the data. An authenticated user can run scripts in the browsers of people who view their profile and read the non-HttpOnly f-session cookie.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["paicoding","java","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"visitors' session cookies are stolen and scripts run in their browsers","analyst_note":"Confirm the fixed version from the NVD or project advisory; sources given name no fixed release.","how_to_check":"- Check the paicoding version in the deployed project's pom.xml or release tag, `1.0.0` through `1.0.3` are affected.\n- Look for the SeoInjectService class and its JSON-LD output on profile pages.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-1.0.0-1.0.3","no-public-profiles"],"who_is_affected":"Sites running paicoding 1.0.0 through 1.0.3 where users can edit profile text that is rendered on public profile pages. Attackers need a registered account, and the flaw is in the profile page rendering, so sites without public profiles or with a different version can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4614,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129141':15A,18A '-2026':14A,17A '1.0.0':26B,81C '1.0.3':28B,83C 'add':111C 'attack':109C 'authent':56B,108C 'break':50B 'browser':63B 'close':44B,113C 'contain':84C 'cooki':79B,139C 'cross':88C 'cross-sit':87C 'cve':13A,16A 'data':54B 'element':41B,107C 'emb':94C 'escap':99C 'execut':122C 'f':77B,137C 'f-session':76B,136C 'follow':116C 'host':24B 'html':118C 'httpon':75B,135C 'inlin':36B,102C 'java':19B 'json':38B,104C 'json-ld':37B,103C 'ld':39B,105C 'let':4A 'log':6A 'logged-in':5A 'non':74B,134C 'non-httpon':73B,133C 'page':129C 'paicod':1A,20B,25B,80C 'peopl':65B 'profil':2A,31B,49B,69B,96C,121C,128C 'read':71B 'run':9A,59B 'runtim':21B 'script':10A,40B,45B,60B,90C,106C,114C,123C 'self':23B 'self-host':22B 'seoinjectservic':93C 'session':78B,138C 'site':89C 'steal':131C 'store':86C 'tag':46B,115C 'text':3A,32B,97C 'unescap':33B 'user':8A,30B,57B,95C 'view':67B 'visitor':12A,125C 'vulner':91C 'without':98C 'write':29B","nicknames":[],"mitigations":[],"who_affected":"Sites running paicoding 1.0.0 through 1.0.3 where users can edit profile text that is rendered on public profile pages. Attackers need a registered account, and the flaw is in the profile page rendering, so sites without public profiles or with a different version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["java","medium","paicoding","runtime","selfhosted"],"campaign_type":null,"search_a":"'-129141':15A,18A '-2026':14A,17A 'cve':13A,16A 'let':4A 'log':6A 'logged-in':5A 'paicod':1A 'profil':2A 'run':9A 'script':10A 'text':3A 'user':8A 'visitor':12A","search_b":"'1.0.0':26B '1.0.3':28B 'authent':56B 'break':50B 'browser':63B 'close':44B 'cooki':79B 'data':54B 'element':41B 'f':77B 'f-session':76B 'host':24B 'httpon':75B 'inlin':36B 'java':19B 'json':38B 'json-ld':37B 'ld':39B 'non':74B 'non-httpon':73B 'paicod':20B,25B 'peopl':65B 'profil':31B,49B,69B 'read':71B 'run':59B 'runtim':21B 'script':40B,45B,60B 'self':23B 'self-host':22B 'session':78B 'tag':46B 'text':32B 'unescap':33B 'user':30B,57B 'view':67B 'write':29B","search_c":"'1.0.0':81C '1.0.3':83C 'add':111C 'attack':109C 'authent':108C 'close':113C 'contain':84C 'cooki':139C 'cross':88C 'cross-sit':87C 'element':107C 'emb':94C 'escap':99C 'execut':122C 'f':137C 'f-session':136C 'follow':116C 'html':118C 'httpon':135C 'inlin':102C 'json':104C 'json-ld':103C 'ld':105C 'non':134C 'non-httpon':133C 'page':129C 'paicod':80C 'profil':96C,121C,128C 'script':90C,106C,114C,123C 'seoinjectservic':93C 'session':138C 'site':89C 'steal':131C 'store':86C 'tag':115C 'text':97C 'user':95C 'visitor':125C 'vulner':91C 'without':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129141","severity":null,"published_at":"2026-11-13T18:17:38+00:00","modified_at":"2026-11-13T18:17:38+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","fetched_at":"2026-11-13T18:49:29+00:00","note":null}],"documents":[{"id":148605,"url":"https://www.vulncheck.com/advisories/paicoding-1.0.0-through-1.0.3-stored-xss-via-json-ld-profile-description","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}