{"id":"CVE-2026-55600","kind":"vulnerability","aliases":["CVE-2026-55600"],"related":[],"title":"Part-DB: stored HTML injection in BOM validation page via part names","description":"Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a Part name can store HTML markup in the Part name. When another user imports a BOM CSV referencing that Part ID, the malicious Part name is rendered as HTML in the victim's BOM validation result page. This results in a cross-user stored HTML injection issue. JavaScript execution appears to be blocked by the current Content Security Policy, but arbitrary HTML links, forms, images, and CSS-based UI elements can still be injected into a trusted Part-DB page. This issue has been patched in version 2.12.2.","summary":"Part-DB renders BOM validation messages with Twig's raw filter, so a part name containing HTML is output unescaped. A user who can edit a part name can inject HTML, links, forms and images into another user's BOM import result page, though the current Content Security Policy appears to block JavaScript execution.","severity":"medium","cvss":5.7,"epss":0.00297,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","part-db","php","self-hosted"],"not_affected_if":["single-user","trusted-editors-only","version-2.12.2-or-later"],"how_to_check":"- Check the installed Part-DB version (for example in the admin info page or the composer.lock file) and see whether it is below `2.12.2`\n- Look for part names containing HTML tags such as `