PT-2026-42986

Published

2026-05-14

·

Updated

2026-05-14

Description by

CVSS 4.0
5.3
Medium
MetricsAV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:
  • you are using hydratable (an experimental feature at the time of this report)
  • you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. hydratable('someKey', () => [synchronousValue, promiseValue])
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
GHSA-F3CJ-J4F6-WQ85
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com