CVE-2026-32822
Received Received - Intake

DOM-Based XSS in dataCycle-CORE

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthenticated attacker can place arbitrary HTML into flash notifications on public routes and rely on the frontend toast component to inject that content into the DOM with `innerHTML`. This creates a reflected DOM XSS that can be delivered with a crafted link to a public page such as `/docs`. Because the vulnerable JavaScript is loaded by the normal application layout, the issue is not limited to a special debug page or an isolated admin-only view.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-32822
EUVD
EUVD-2026-45981

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
datacycle datacycle-core to 25.07.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected DOM-based cross-site scripting (XSS) vulnerability in dataCycle-CORE versions before 25.07.3. An unauthenticated attacker can inject arbitrary HTML into flash notifications on public pages. The frontend toast component then renders this HTML using innerHTML, allowing malicious scripts to execute in the user's browser when they visit a crafted link to a public page like /docs.

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual requests to public routes like /docs. Check for injected HTML in flash notifications or toast components. Inspect JavaScript files loaded by the application layout for unsafe innerHTML usage.

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or redirect you to malicious sites. Since the vulnerability affects public pages, any user visiting a compromised link could be impacted without needing authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance risks if user data is compromised.

Mitigation Strategies

Update dataCycle-CORE to version 25.07.3 or later. If immediate update is not possible, restrict access to public routes or disable flash notifications. Implement input validation to sanitize HTML content in notifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32822. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart