CVE-2026-55891

Deferred Deferred - Pending Action

JSON-LD Injection in PrivateBin

Publication date: 2026-08-28

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request.php passes $_SERVER['REQUEST_URI'] through FILTER_SANITIZE_URL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::_init() stores the attacker-controlled value in Controller::$_urlBase. Controller::_jsonld() in lib/Controller.php then uses str_replace() to insert that value without JSON escaping into js/types.jsonld, js/paste.jsonld, and the other JSON-LD templates used by /?jsonld= and /?pasteid. A raw quotation mark delivered by an HTTP client, proxy, or structured-data crawler that does not normalize the request target can break out of the JSON string and inject arbitrary key-value data into a CORS-open application/ld+json response. The jsonld branch in Controller::__construct() returns before _setCacheHeaders(), so the response also lacks X-Content-Type-Options: nosniff, Content Security Policy, X-Frame-Options, and Referrer-Policy. Direct script execution was not demonstrated, but manipulated responses can affect structured-data consumers or combine with less strict clients. This issue is fixed in version 2.0.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-09

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-55891

Affected Vendors & Products

Vendor	Product	Version / Range
privatebin	privatebin	to 2.0.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

PrivateBin is a pastebin service that claims to keep pasted data private from the server. The vulnerability involves improper handling of the REQUEST_URI parameter. The function Request::getRequestUri() sanitizes the URI but fails to remove certain special characters like quotation marks or angle brackets. This unsanitized value is then used in Controller::_jsonld() to construct JSON-LD responses without proper JSON escaping. Attackers can inject arbitrary data into these responses by crafting malicious URIs.

Detection Guidance

To detect this vulnerability, check the PrivateBin version installed on your system. If it is below 2.0.5, the system is vulnerable. Inspect server responses for JSON-LD endpoints like /?jsonld= or /?pasteid to see if they contain unexpected data injection. Monitor for missing security headers such as X-Content-Type-Options, Content Security Policy, X-Frame-Options, and Referrer-Policy in responses from these endpoints.

Impact Analysis

This vulnerability allows attackers to inject arbitrary key-value data into JSON-LD responses served by PrivateBin. While direct script execution was not demonstrated, manipulated responses could affect structured-data consumers or combine with less strict clients to cause unintended behavior. The lack of security headers like X-Content-Type-Options further increases risk of misinterpretation by clients.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling data injection into JSON-LD responses. If exploited, it may allow unauthorized modification of structured data, which could lead to improper handling of sensitive information. The lack of security headers like Content Security Policy and X-Content-Type-Options further increases exposure to compliance risks.

Mitigation Strategies

Upgrade PrivateBin to version 2.0.5 or later to address the vulnerability. Ensure your server configuration includes proper security headers like X-Content-Type-Options: nosniff, Content Security Policy, X-Frame-Options, and Referrer-Policy.

Hi! I’m here to help you understand CVE-2026-55891. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70