Live › vulnerability › CVE-2026-54615
Go to dashboardPart-DB's activity log and element history do not escape the names of deleted collection sub-elements, so HTML inserted by an editor is rendered as live markup. An attacker with edit rights can run script in the browser of an administrator or auditor who views the log, though the content security policy blocks inline script under normal conditions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Part-DB instances below 2.12.1 where users with edit rights on parts can create or modify sub-elements (parameters, attachments, lots, orderdetails) and where administrators or auditors open the activity log or element history. Instances where only trusted users can edit, or that are on 2.12.1 or later, are not exposed.
No product ranges from the sources yet.
composer show in the Part-DB directory, or the version shown in the web footer); versions below 2.12.1 are affected.script-src restrictions to judge how far the injected markup can go.2.12.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns — except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element — a part Parameter, Attachment, PartLot, Orderdetail, etc. — all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged victim (an administrator/auditor with system.show_logs, or any user viewing that element's history). This is a stored cross-site-scripting / HTML-injection defect caused by a single missed sanitizer in one sibling branch. CSP policies block inline javascript execution under normal conditions. This issue has been patched in version 2.12.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-54615")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.