CVE-2026-54064: NukeViet Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module
Summary
CVE-2026-54064: NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module. Affects nukeviet/nukeviet versions < 4.6.00. Fixed in 4.6.00. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NukeViet is an open-source content management system (CMS) designed for building websites and managing online content. It offers a variety of features including a news module that allows users to post articles. However, due to certain vulnerabilities in its filtering mechanisms, low-privileged users can exploit these weaknesses to inject malicious scripts into the system, potentially affecting all visitors to the site.
Vulnerability Detail
The vulnerability arises from two filter-bypass techniques in the NukeViet core request handling methods. The first bypass allows attackers to prefix event handler names with the ASCII Form Feed character, which is not stripped by the filtering mechanism, enabling the execution of arbitrary JavaScript. The second bypass involves the use of decimal HTML entities within 'javascript:' URIs, which are not adequately filtered, allowing attackers to store and execute malicious scripts. This can lead to severe consequences, including session cookie theft, credential harvesting, and unauthorized access to sensitive information.
How To Fix
Minimum fixed version
4.6.00
This is the first release that contains the fix.
composer require nukeviet/nukeviet:4.6.00Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no effective workarounds for this vulnerability. The recommended action is to update to the patched version as soon as possible.
Conclusion
The NukeViet CMS has a critical vulnerability that allows low-privileged users to execute arbitrary JavaScript through stored XSS attacks. Immediate action is required to update to the latest version to protect against potential exploitation.
See every vulnerability recorded for nukeviet/nukeviet →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
Any authenticated user with news-posting permissions can exploit this vulnerability to inject malicious scripts.
The potential impacts include session cookie theft, credential harvesting, defacement of the website, and further privilege escalation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
There are no effective workarounds available. The best course of action is to update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for nukeviet/nukeviet.
