CVE-2026-95812 in ClipBucket
Summary
by MITRE • 09/22/2026
ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
ClipBucket versions prior to 5.5.3-#182 are susceptible to a reflected cross-site scripting vulnerability located within the sort_link helper function. This security flaw stems from an insufficient sanitization of user-supplied input, specifically targeting the cat, sort, and time query parameters passed via HTTP requests. The application fails to properly validate or encode these inputs before incorporating them into the generated HTML response. Consequently, when a victim interacts with a maliciously crafted URL containing embedded script payloads within these specific parameters, the browser executes the injected JavaScript code in the context of the ClipBucket origin. This behavior aligns with Common Weakness Enumeration identifier CWE-79, which classifies improper neutralization of input during web page generation as a critical security risk for client-side applications.
The operational impact of this vulnerability allows attackers to execute arbitrary scripts on behalf of authenticated or unauthenticated users visiting the compromised endpoint. By leveraging reflected XSS, an attacker can potentially steal session cookies, hijack user sessions, perform actions on behalf of the victim such as changing account settings or uploading malicious content, and redirect users to phishing sites designed to harvest credentials. The lack of output encoding means that any script tag, event handler, or JavaScript expression injected into these parameters will be rendered and executed by the victim's browser without restriction. This capability undermines the confidentiality, integrity, and availability of user data within the ClipBucket platform, as attackers can manipulate the client-side environment to bypass security controls implemented at the application level.
From a tactical perspective, this vulnerability maps directly to the MITRE ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution in web browsers. The attack vector relies on social engineering or link manipulation to deliver the payload via search engines, email, or direct messaging, exploiting the trust users place in legitimate application URLs. To mitigate this risk, developers must implement strict input validation and output encoding strategies. All user-supplied data, particularly query parameters used dynamically within HTML content, should be encoded using context-aware methods such as HTML entity encoding to prevent script execution. Additionally, implementing a Content Security Policy with appropriate directives can provide an additional layer of defense by restricting the sources from which scripts are allowed to load and execute. Upgrading to version 5.5.3-#182 or later is essential to resolve this flaw, ensuring that the sort_link function properly sanitizes all incoming parameters before rendering them in the response stream.