CVE-2026-112038
Received Received - Intake

Cross-Site Scripting in Diem Project via Version Check Service

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112038
EUVD
EUVD-2026-104033

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
diem-project diem 116974edfb9a5b8bd69cb13586dc62bcdbb485ad

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) flaw in the diem-project's administrative application. It occurs because the version check service uses an insecure HTTP URL, allowing an attacker to inject malicious HTML markup into the response. The application then inserts this response directly into the DOM using the .html() function without proper sanitization or encoding. This enables an attacker to execute arbitrary JavaScript in the context of the administrative session.

Detection Guidance

To detect this vulnerability, monitor network traffic for HTTP requests to the version-check URL. Check if the admin application's version-check response contains executable HTML or JavaScript. Inspect dmAdminPlugin/web/js/dmAdminCtrl.js for the .html() function usage and verify if output encoding is disabled.

Impact Analysis

If you are an administrator using the affected version of the diem-project, an attacker could exploit this to perform actions on your behalf, steal sensitive data, or manipulate the user interface. The attack requires an attacker to be on the same network path (on-path attacker) and does not require authentication. The injected script runs in the administrative origin, allowing full control over the admin session.

Compliance Impact

This vulnerability enables cross-site scripting (XSS) in the administrative application, allowing an attacker to inject malicious scripts into the DOM. This could lead to unauthorized data access, manipulation, or theft, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Immediately switch the version-check URL to HTTPS to prevent on-path attacks. Ensure the version string is properly parsed and sanitized before being inserted into the DOM. Enable output encoding and set escaping_strategy to true in the admin application to block HTML injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112038. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart