givanz Vvveb up to 1.0.8.1 isEditor r/_component_ajax cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, was found in givanz Vvveb. The affected element is the function isEditor. Executing a manipulation of the argument r/_component_ajax can lead to cross site scripting. This vulnerability is tracked as CVE-2026-41929. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in givanz Vvveb. This vulnerability affects the function isEditor. The manipulation of the argument r/_component_ajax with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and _component_ajax POST parameter. Attackers can craft a malicious link or auto-submitted form that causes victims to execute attacker-controlled JavaScript in the context of the Vvveb origin, as the gating function isEditor() performs no session, role, or token verification and the view handler injects raw HTML POST body content without sanitization.

The weakness was disclosed by Basant Kumar as GHSA-wwmv-4g9g-p48g. The advisory is shared for download at github.com. This vulnerability was named CVE-2026-41929 since 04/22/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 1.0.8.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 54a9e846fb94192f1b31ae81d81d25c874662e6a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• givanz

Name

• Vvveb

Version

• 1.0.5
• 1.0.6
• 1.0.6.1
• 1.0.7
• 1.0.7.2
• 1.0.8
• 1.0.8.1

License

• open-source

Website

• Product: https://github.com/givanz/Vvveb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion