{"id":"CVE-2026-54615","kind":"vulnerability","aliases":["CVE-2026-54615"],"related":[],"title":"Part-DB: stored XSS in activity log via deleted sub-element names","description":"Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the \"Extra\" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns — except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element — a part Parameter, Attachment, PartLot, Orderdetail, etc. — all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged victim (an administrator/auditor with system.show_logs, or any user viewing that element's history). This is a stored cross-site-scripting / HTML-injection defect caused by a single missed sanitizer in one sibling branch. CSP policies block inline javascript execution under normal conditions. This issue has been patched in version 2.12.1.","summary":"Part-DB's activity log and element history do not escape the names of deleted collection sub-elements, so HTML inserted by an editor is rendered as live markup. An attacker with edit rights can run script in the browser of an administrator or auditor who views the log, though the content security policy blocks inline script under normal conditions.","severity":"medium","cvss":6.0,"epss":0.00297,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["inventory","package","part-db","self-hosted"],"not_affected_if":["patched-2.12.1"],"how_to_check":"- Check the installed Part-DB version (`composer show` in the Part-DB directory, or the version shown in the web footer); versions below `2.12.1` are affected.\n- Review the instance's content security policy headers for `script-src` restrictions to judge how far the injected markup can go.","fix":"- Upgrade Part-DB to `2.12.1` or later.\n- Until upgraded, restrict edit rights on parts and their sub-elements to trusted users.","status":"open","published_at":"2026-10-23T04:18:16+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:05:23+00:00","updated_at":"2026-10-25T04:05:23+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:05:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Part-DB to `2.12.1` or later.\n- Until upgraded, restrict edit rights on parts and their sub-elements to trusted users.","reach":"internet","title":"Part-DB: stored XSS in activity log via deleted sub-element names","impact":"medium","summary":"Part-DB's activity log and element history do not escape the names of deleted collection sub-elements, so HTML inserted by an editor is rendered as live markup. An attacker with edit rights can run script in the browser of an administrator or auditor who views the log, though the content security policy blocks inline script under normal conditions.","category":"package","nicknames":[],"who_cares":["part-db","self-hosted","inventory"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker script runs in an admin's browser session, enabling account takeover","analyst_note":"","how_to_check":"- Check the installed Part-DB version (`composer show` in the Part-DB directory, or the version shown in the web footer); versions below `2.12.1` are affected.\n- Review the instance's content security policy headers for `script-src` restrictions to judge how far the injected markup can go.","needs_analyst":false,"not_affected_if":["patched-2.12.1"],"who_is_affected":"Self-hosted Part-DB instances below 2.12.1 where users with edit rights on parts can create or modify sub-elements (parameters, attachments, lots, orderdetails) and where administrators or auditors open the activity log or element history. Instances where only trusted users can edit, or that are on 2.12.1 or later, are not exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":3751,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-54615':17A,20A '/log':123C '2.12.1':107C,321C 'activ':7A,33B,120C 'activity-log':119C 'administr':73B 'administrator/auditor':271C 'attach':208C 'attack':61B 'auditor':75B 'block':85B,307C 'branch':130C,152C,304C 'browser':70B,263C 'build':109C 'bundl':183C 'call':191C 'caus':295C 'cell':181C 'collect':45B,201C 'collectionelementdelet':151C 'collectionelementdeleted.getoldname':194C 'column':116C,187C,190C 'compon':103C 'condit':90B,313C 'content':82B,229C 'control':137C 'cross':288C 'cross-site-script':287C 'csp':305C 'cve':15A,18A 'datat':180C 'db':3A,25B,31B,93C 'defect':294C 'delet':10A,44B,200C,246C 'dom':260C 'edit':63B,219C 'editor':54B,230C 'electron':102C 'element':13A,36B,48B,126C,204C,224C,245C,280C 'emit':169C 'entri':252C 'escap':40B,164C,186C 'etc':211C 'everi':129C 'except':149C 'execut':310C 'extra':115C 'freeli':213C 'getcollectionnam':157C 'getinternalformat':133C 'getoldnam':155C 'higher':267C 'higher-privileg':266C 'histori':37B,127C,282C 'host':28B 'html':50B,111C,146C,177C,292C 'html-inject':291C 'html/script':235C 'htmlspecialchar':140C,192C 'inject':293C 'inlin':86B,308C 'insert':51B,174C 'interpol':154C 'inventori':21B,98C 'issu':315C 'javascript':309C 'live':58B,259C 'log':8A,34B,79B,121C,251C,274C 'logentryextracolumn':171C 'logentryextraformatt':108C,132C 'low':227C 'low-privileg':226C 'manag':99C 'markup':59B,256C 'miss':299C 'name':14A,42B,197C,239C 'normal':89B,312C 'one':302C 'open':96C 'orderdetail':210C 'output':188C 'own':223C 'packag':22B 'paramet':207C 'pars':257C 'part':2A,24B,30B,92C,206C 'part-db':1A,23B,29B,91C 'partlot':209C 'patch':318C 'payload':236C 'place':142C 'polici':84B,306C 'prior':104C 'privileg':228C,268C 'raw':176C 'render':56B,172C 'return':148C,166C 'right':64B,220C 'run':66B,134C 'sanit':300C 'script':67B,87B,290C 'secur':83B 'self':27B 'self-host':26B 'set':214C 'shown':112C 'sibl':189C,303C 'singl':298C 'site':289C 'sourc':97C 'sprintf':160C 'store':4A,233C,286C 'string':138C,167C 'sub':12A,47B,203C,244C 'sub-el':11A,46B,202C,243C 'system':100C 'system.show':273C 'tabl':122C,128C 'templat':161C 'therefor':232C 'though':80B 'user':136C,217C,277C 'user-control':135C 'version':106C,320C 'via':9A 'victim':269C 'view':77B,278C 'write':249C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Part-DB instances below 2.12.1 where users with edit rights on parts can create or modify sub-elements (parameters, attachments, lots, orderdetails) and where administrators or auditors open the activity log or element history. Instances where only trusted users can edit, or that are on 2.12.1 or later, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T04:18:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54615","severity":null,"published_at":"2026-10-23T04:18:16+00:00","modified_at":"2026-10-23T19:36:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-54615","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54615","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}