PAICODING · CVE-2026-129142 · Other
NO FIX YET
paicoding, a Java blogging platform, renders a payer's display name unescaped in payment notifications, so the name is stored and run as script. An attacker with an account can run script in the article author's browser when the author views notifications.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only deployments of the paicoding project in the affected commit range that accept paid articles and show payment notifications to authors. The flaw needs an account to set the display name and a payment to start, and it executes in the author's browser when notifications are viewed. Sites on other commits or without the payment feature are not described as affected.
Not affected if no-payment-feature, outside-commit-range
Who cares java, paicoding, self-hosted
766c48b and 903adcenotify-system-item.html using th:utext to render the payer nameNo fix yet, per the sources.
paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author's browser when the author views notifications.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.