{"id":"CVE-2026-129142","kind":"vulnerability","aliases":["CVE-2026-129142"],"related":[],"title":"paicoding: stored script injection through payment notification display names","description":"paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author's browser when the author views notifications.","summary":"paicoding, a Java blogging platform, renders a payer's display name unescaped in payment notifications, so the name is stored and run as script. An attacker with an account can run script in the article author's browser when the author views notifications.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"paicoding","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["java","other","paicoding","self-hosted"],"not_affected_if":["no-payment-feature","outside-commit-range"],"how_to_check":"- Check whether your deployment runs paicoding built from commits between `766c48b` and `903adce`\n- Look for the template `notify-system-item.html` using `th:utext` to render the payer name","fix":null,"status":"open","published_at":"2026-11-13T18:17:38+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","triaged_at":"2026-11-13T18:51:56+00:00","updated_at":"2026-11-13T18:51:56+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T18:51:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"paicoding: stored script injection through payment notification display names","impact":"medium","summary":"paicoding, a Java blogging platform, renders a payer's display name unescaped in payment notifications, so the name is stored and run as script. An attacker with an account can run script in the article author's browser when the author views notifications.","audience":"businesses","category":"other","nicknames":[],"who_cares":["paicoding","java","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in the author's browser session","analyst_note":"Confirm fixed commit or version and check the vulnerable template in the upstream repo; sources give no fix.","how_to_check":"- Check whether your deployment runs paicoding built from commits between `766c48b` and `903adce`\n- Look for the template `notify-system-item.html` using `th:utext` to render the payer name\n- unknown","plain_action":"","product_name":"paicoding","needs_analyst":true,"not_affected_if":["outside-commit-range","no-payment-feature"],"who_is_affected":"Only deployments of the paicoding project in the affected commit range that accept paid articles and show payment notifications to authors. The flaw needs an account to set the display name and a payment to start, and it executes in the author's browser when notifications are viewed. Sites on other commits or without the payment feature are not described as affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000729,"input_tokens":4605,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129142':12A,15A '-2026':11A,14A '766c48b':68C '903adce':71C 'account':51B 'articl':57B,115C 'attack':48B,100C 'authent':99C 'author':58B,63B,120C,125C 'blog':26B 'browser':60B,122C 'commit':67C,70C 'contain':72C 'cross':76C 'cross-sit':75C 'cve':10A,13A 'display':8A,32B,89C,105C 'execut':116C 'host':22B 'inject':4A 'insert':85C 'java':17B,25B 'malici':104C 'name':9A,33B,40B,90C,106C 'notif':7A,37B,65B,82C,127C 'notify-system-item.html':93C 'notifymsglisten':84C 'paicod':1A,19B,23B,66C 'paicoding':16A 'paid':114C 'payer':30B,87C 'payment':6A,36B,81C,111C 'pend':110C 'platform':27B 'render':28B,94C 'run':44B,53B 'script':3A,46B,54B,78C,117C 'self':21B 'self-host':20B 'set':102C 'site':77C 'start':108C 'store':2A,42B,74C 'th':97C 'unescap':34B,91C 'utext':98C 'via':96C 'view':64B,126C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Only deployments of the paicoding project in the affected commit range that accept paid articles and show payment notifications to authors. The flaw needs an account to set the display name and a payment to start, and it executes in the author's browser when notifications are viewed. Sites on other commits or without the payment feature are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["paicoding"],"ptokens":["paicoding"],"labels":["java","medium","other","paicoding","selfhosted","vendor"],"campaign_type":null,"search_a":"'-129142':12A,15A '-2026':11A,14A 'cve':10A,13A 'display':8A 'inject':4A 'name':9A 'notif':7A 'paicod':1A 'paicoding':16A 'payment':6A 'script':3A 'store':2A","search_b":"'account':51B 'articl':57B 'attack':48B 'author':58B,63B 'blog':26B 'browser':60B 'display':32B 'host':22B 'java':17B,25B 'name':33B,40B 'notif':37B,65B 'paicod':19B,23B 'payer':30B 'payment':36B 'platform':27B 'render':28B 'run':44B,53B 'script':46B,54B 'self':21B 'self-host':20B 'store':42B 'unescap':34B 'view':64B","search_c":"'766c48b':68C '903adce':71C 'articl':115C 'attack':100C 'authent':99C 'author':120C,125C 'browser':122C 'commit':67C,70C 'contain':72C 'cross':76C 'cross-sit':75C 'display':89C,105C 'execut':116C 'insert':85C 'malici':104C 'name':90C,106C 'notif':82C,127C 'notify-system-item.html':93C 'notifymsglisten':84C 'paicod':66C 'paid':114C 'payer':87C 'payment':81C,111C 'pend':110C 'render':94C 'script':78C,117C 'set':102C 'site':77C 'start':108C 'store':74C 'th':97C 'unescap':91C 'utext':98C 'via':96C 'view':126C 'vulner':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129142","severity":null,"published_at":"2026-11-13T18:17:38+00:00","modified_at":"2026-11-13T18:17:38+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","fetched_at":"2026-11-13T18:49:29+00:00","note":null}],"documents":[{"id":148606,"url":"https://www.vulncheck.com/advisories/paicoding-commit-766c48b-through-903adce-stored-xss-via-payment-notifications","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}