Live › vulnerability › CVE-2026-2102
The CREST framework's HTTP binding copies the _mimeType request parameter into the Content-Type response header without sanitizing it, so a JSON response can be served as HTML. An attacker who gets a user to open a crafted URL can run arbitrary JavaScript in that user's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Applications that embed the CREST framework and expose its HTTP binding to browsers are exposed, since the flaw is triggered through a crafted GET URL against any deployed CREST endpoint. Services that use CREST only internally, with no browser-facing HTTP binding, are less exposed. The sources do not say whether authentication changes exposure.
No product ranges from the sources yet.
22.6.2 on the 22.x line or below 23.0.0 on the 23.x line.22.6.2 on the 22.x line or 23.0.0 on the 23.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-2102")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.