Live › vulnerability › CVE-2026-55600
Go to dashboardPart-DB renders BOM validation messages with Twig's raw filter, so a part name containing HTML is output unescaped. A user who can edit a part name can inject HTML, links, forms and images into another user's BOM import result page, though the current Content Security Policy appears to block JavaScript execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Instances of Part-DB before 2.12.2 where more than one user can edit part names and other users import BOM CSV files referencing those parts. Single-user installations or installations where only trusted staff edit parts have a much smaller exposure. Deployments already on 2.12.2 or later are not affected.
No product ranges from the sources yet.
2.12.2<a, <form or <img in the parts table2.12.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a Part name can store HTML markup in the Part name. When another user imports a BOM CSV referencing that Part ID, the malicious Part name is rendered as HTML in the victim's BOM validation result page. This results in a cross-user stored HTML injection issue. JavaScript execution appears to be blocked by the current Content Security Policy, but arbitrary HTML links, forms, images, and CSS-based UI elements can still be injected into a trusted Part-DB page. This issue has been patched in version 2.12.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-55600")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.