{"id":"CVE-2026-2102","kind":"vulnerability","aliases":["CVE-2026-2102"],"related":[],"title":"wrensec-commons CREST: reflected XSS via _mimeType parameter in HTTP binding","description":"wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0.","summary":"The CREST framework's HTTP binding copies the _mimeType request parameter into the Content-Type response header without sanitizing it, so a JSON response can be served as HTML. An attacker who gets a user to open a crafted URL can run arbitrary JavaScript in that user's browser.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crest","java","package","web-apps","wrensec-commons"],"not_affected_if":["no-http-binding","non-browser-clients"],"how_to_check":"- Find the CREST version in your build file or dependency tree and check whether it is below `22.6.2` on the 22.x line or below `23.0.0` on the 23.x line.\n- Confirm whether the application exposes CREST HTTP endpoints.","fix":"- Upgrade to `22.6.2` on the 22.x line or `23.0.0` on the 23.x line.","status":"open","published_at":"2026-11-02T16:17:40+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","triaged_at":"2026-11-02T16:26:45+00:00","updated_at":"2026-11-02T16:26:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-02T16:26:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `22.6.2` on the 22.x line or `23.0.0` on the 23.x line.","reach":"internet","title":"wrensec-commons CREST: reflected XSS via _mimeType parameter in HTTP binding","impact":"medium","summary":"The CREST framework's HTTP binding copies the _mimeType request parameter into the Content-Type response header without sanitizing it, so a JSON response can be served as HTML. An attacker who gets a user to open a crafted URL can run arbitrary JavaScript in that user's browser.","audience":"developers","category":"package","nicknames":[],"who_cares":["crest","java","wrensec-commons","web-apps"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs arbitrary JavaScript in a victim's browser session","analyst_note":"","how_to_check":"- Find the CREST version in your build file or dependency tree and check whether it is below `22.6.2` on the 22.x line or below `23.0.0` on the 23.x line.\n- Confirm whether the application exposes CREST HTTP endpoints.","plain_action":"","needs_analyst":false,"not_affected_if":["no-http-binding","non-browser-clients"],"who_is_affected":"Applications that embed the CREST framework and expose its HTTP binding to browsers are exposed, since the flaw is triggered through a crafted GET URL against any deployed CREST endpoint. Services that use CREST only internally, with no browser-facing HTTP binding, are less exposed. The sources do not say whether authentication changes exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000727,"input_tokens":4299,"output_tokens":594,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-2102':15A,18A '22.6.2':172C '23.0.0':174C 'app':24B 'arbitrari':71B,141C 'attack':59B,125C 'bind':12A,33B,96C 'browser':77B,129C,147C 'caus':127C 'common':3A,27B,80C 'contain':81C 'content':42B,109C 'content-typ':41B,108C 'copi':34B 'could':126C 'craft':67B,159C 'crest':4A,19B,29B,92C,133C,164C 'cross':85C 'cross-sit':84C 'cve':13A,16A 'deploy':163C 'enabl':138C 'endpoint':165C 'execut':139C 'exploit':151C 'fix':169C 'framework':30B,93C 'get':61B,119C 'header':45B,112C 'html':57B,137C 'http':11A,32B,95C 'httputils.prepareresponse':98C 'interpret':131C 'issu':167C 'java':20B 'javascript':72B,142C 'json':51B,134C 'method':99C 'mimetyp':8A,36B,102C,122C 'open':65B 'packag':21B 'paramet':9A,38B,104C 'proper':114C 'reflect':5A,83C 'request':37B,103C,120C 'respons':44B,52B,111C,135C 'run':70B 'sanit':47B,115C 'script':87C 'send':117C 'serv':55B 'set':106C 'site':86C 'target':161C 'text/html':123C 'trick':153C 'type':43B,110C 'url':68B,160C 'use':100C 'user':63B,75B,155C 'version':171C 'via':7A 'victim':145C 'visit':157C 'vulner':89C,149C 'web':23B 'web-app':22B 'without':46B,113C 'wrensec':2A,26B,79C 'wrensec-common':1A,25B,78C 'xss':6A,88C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed the CREST framework and expose its HTTP binding to browsers are exposed, since the flaw is triggered through a crafted GET URL against any deployed CREST endpoint. Services that use CREST only internally, with no browser-facing HTTP binding, are less exposed. The sources do not say whether authentication changes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crest","java","medium","package","webapps","wrenseccommons"],"first_public_at":"2026-11-02T15:03:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"b6ef82d7-f637-461b-aedd-74f5857d5f5b","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-2102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2102","severity":null,"published_at":"2026-11-02T16:17:40+00:00","modified_at":"2026-11-02T16:20:30+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","fetched_at":"2026-11-02T16:24:04+00:00","note":null}],"documents":[{"id":52768,"url":"https://github.com/WrenSecurity/wrensec-commons/commit/5b50c64c14943b6f4d7faf996345e603956bae1d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52769,"url":"https://github.com/WrenSecurity/wrensec-commons/commit/65bbfd8c63c42e84ff7699aa5b82a22c08a12624","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52770,"url":"https://github.com/WrenSecurity/wrensec-commons/security/advisories/GHSA-4vhv-49g2-496q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-02T15:03:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}