CVE-2026-112038 in diem
Summary
by MITRE • 10/19/2026
A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The identified vulnerability resides within the diem-project's Version Check Service component, specifically affecting versions up to commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. The flaw is located in the html function of the JavaScript file dmAdminCtrl.js within the dmAdminPlugin directory. This component serves as a critical interface for administrative operations, and its compromise poses significant risks to the integrity and security of the application environment. Because the project utilizes a rolling release model for continuous delivery, specific version numbers are not provided to delineate affected releases, requiring administrators to assess their current commit hash against the disclosed vulnerable range rather than relying on traditional semantic versioning indicators.
The technical nature of this vulnerability is classified as Cross-Site Scripting, commonly referred to by its acronym XSS. This flaw arises from insufficient input validation or improper output encoding within the html function, allowing an attacker to inject malicious client-side scripts into web pages viewed by other users. When a victim interacts with the compromised page, the injected script executes in the context of the application's domain. This bypasses standard browser security mechanisms such as the same-origin policy, enabling the malicious code to access sensitive data stored within cookies or local storage, perform actions on behalf of the user, and potentially redirect the user to external sites controlled by the attacker. The presence of this vulnerability indicates a failure in implementing secure coding practices regarding dynamic content generation.
From an operational perspective, the impact of exploiting this cross-site scripting flaw is severe due to its remote exploitability. Attackers can deliver malicious payloads through various vectors, including phishing emails with links to compromised pages or by manipulating input fields that are reflected back into the page without sanitization. Successful exploitation allows for session hijacking, where the attacker steals authentication tokens to impersonate legitimate users and gain unauthorized access to administrative functions. It also facilitates data theft, allowing the extraction of sensitive information such as user credentials, personal identifiable information, or proprietary business data stored within the application's local storage. Furthermore, attackers can deface web pages or deploy further malware onto client systems by leveraging the trusted context of the vulnerable application.
This vulnerability aligns with CWE-79, which defines Improper Neutralization of Input During Web Page Generation as a Cross-site Scripting weakness. The attack pattern corresponds to ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution, and falls under the broader category of Initial Access via Spearphishing Link if delivered through social engineering or Collection from Local System Data if used to exfiltrate stored credentials. The fact that the exploit has been disclosed publicly means that automated scanning tools and malicious actors are likely already aware of this weakness, increasing the urgency for remediation. Although the project maintainers were notified early via an issue report, their lack of response necessitates immediate action by users who have not yet patched or migrated away from the vulnerable codebase.
Mitigation strategies should focus on both technical fixes and architectural changes. The primary remedy is to implement strict input validation and output encoding for all data rendered into HTML contexts using the affected html function. Developers must ensure that special characters are escaped properly before being inserted into the DOM, preventing the browser from interpreting injected strings as executable code. Additionally, implementing Content Security Policy headers can significantly reduce the impact of successful XSS attacks by restricting the sources from which scripts can be loaded and executed. For organizations relying on this specific version of diem-project, it is advisable to monitor official channels for updates or consider migrating to a supported alternative if no patch becomes available promptly due to the project's unresponsive maintenance status.