CVE-2026-129259 · Package
NO FIX YET
VanBlog up to version 0.54.0 has a weakness in its image upload endpoint that allows cross-site scripting. A remote attacker can run scripts in the browser of a user who opens the affected content, and a public exploit is available.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
VanBlog deployments at version 0.54.0 or earlier that expose the image upload endpoint. The sources do not say which configuration is required, and do not name a fixed version. The vendor did not respond to the disclosure, so no patch is confirmed.
Not affected if unknown
Who cares node.js, self-hosted, vanblog
0.54.0; versions up to and including 0.54.0 are listed as affected.packages/server/src/types/access/access.ts in the VanBlog source for the image upload access logic.No fix yet, per the sources.
A weakness has been identified in Mereithhh VanBlog up to 0.54.0. This affects an unknown part of the file packages/server/src/types/access/access.ts of the component Image Upload Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.