---
id: "CVE-2026-129142"
page: "https://infrastack.ai/live/CVE-2026-129142"
kind: "vulnerability"
aliases: ["CVE-2026-129142"]
title: "paicoding: stored script injection through payment notification display names"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "paicoding", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["java", "other", "paicoding", "self-hosted"]
not_affected_if: ["no-payment-feature", "outside-commit-range"]
published_at: "2026-11-13T18:17:38+00:00"
first_seen_at: "2026-11-13T18:49:29+00:00"
updated_at: "2026-11-13T18:51:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129142", "first_seen_at": "2026-11-13T18:49:29+00:00"}]
exploit_sources: []
---

# paicoding: stored script injection through payment notification display names

Link for people: https://infrastack.ai/live/CVE-2026-129142 (this .md is for agents)

paicoding, a Java blogging platform, renders a payer's display name unescaped in payment notifications, so the name is stored and run as script. An attacker with an account can run script in the article author's browser when the author views notifications.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:paicoding affected range not listed fixed no fixed version listed

## How to check

- Check whether your deployment runs paicoding built from commits between `766c48b` and `903adce`
- Look for the template `notify-system-item.html` using `th:utext` to render the payer name

## Timeline

- 2026-11-13T18:49:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129142

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/paicoding-commit-766c48b-through-903adce-stored-xss-via-payment-notifications

## From the sources

paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author's browser when the author views notifications.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_