CVE-2026-122144
Deferred Deferred - Pending Action

Cross-Site Request Forgery in pico-content-editor

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulDB

Description
A security flaw has been discovered in nliautaud pico-content-editor up to 02d5ad6c820c5050c542ab9505819b5e0a0ba1af. This vulnerability affects unknown code. The manipulation results in cross-site request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-122144
EUVD
EUVD-2026-117200

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nliautaud pico-content-editor 02d5ad6c820c5050c542ab9505819b5e0a0ba1af

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site request forgery (CSRF) flaw in the nliautaud pico-content-editor up to a specific commit hash. It allows attackers to trick users into executing unwanted actions on the web application without their consent. The exploit is publicly available and can be launched remotely.

Impact Analysis

An attacker could exploit this to perform unauthorized actions on your behalf if you are logged into the affected editor. This might include modifying content, changing settings, or other actions without your knowledge. Since the product is no longer supported, there are no patches available.

Compliance Impact

This CSRF vulnerability could lead to unauthorized modifications of sensitive data, potentially violating GDPR (data integrity) or HIPAA (unauthorized access to health information). Compliance may be compromised if user actions are manipulated without consent.

Mitigation Strategies

Immediately discontinue use of the affected nliautaud pico-content-editor versions. Since the product is no longer supported and a public exploit exists, migrate to an alternative supported editor. Monitor network traffic for unusual cross-site request forgery patterns targeting this component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...