PT-2026-137986
CVE-2026-84164
·
Published
2026-11-06
·
Updated
2026-11-06
Description by
CVSS 4.0
0.0
Not availableMetricsAV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
CodeChecker (affected versions not specified)
Description
Reports generated by
plist-to-html, CodeChecker parse --export html, and CodeChecker cmd diff --output html are susceptible to cross-site scripting. The software uses json.dumps to place the report message, checker name, and source file path into a script block. Because json.dumps does not escape the less-than character, a closing script tag in any of these fields can terminate the script element, allowing subsequent content to be parsed as HTML. This occurs when the report is published in an environment without a restrictive Content Security Policy (CSP), which is a security layer that helps detect and mitigate certain types of attacks, including cross-site scripting.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploitability
Exploit
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾