CVE-2026-55891: PrivateBin Reflected JSON Injection Vulnerability
Summary
CVE-2026-55891: PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI. Affects privatebin/privatebin versions < 2.0.5. Fixed in 2.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PrivateBin is an open-source, minimalist online pastebin that allows users to share text snippets securely. It offers features such as end-to-end encryption, self-destruction of pastes, and a simple user interface. However, it is vulnerable to a reflected JSON injection issue that can lead to unauthorized data exposure.
Vulnerability Detail
The vulnerability arises from the improper sanitization of the REQUEST_URI in PrivateBin. The function Request::getRequestUri() uses FILTER_SANITIZE_URL, which does not remove certain characters like quotes and angle brackets. This allows an attacker to inject arbitrary JSON data into responses by crafting a request with a raw quote character. The lack of proper escaping in the JSON response can lead to a broken JSON structure, potentially exposing sensitive information to unauthorized users. The vulnerability is exacerbated by the absence of security headers like X-Content-Type-Options: nosniff on the affected response path.
How To Fix
Minimum fixed version
2.0.5
This is the first release that contains the fix.
composer require privatebin/privatebin:2.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using request URIs that contain special characters such as quotes or angle brackets until the package is updated. Additionally, you can implement server-side filtering to reject such requests.
Conclusion
The reflected JSON injection vulnerability in PrivateBin can lead to significant security risks if left unaddressed. Users are strongly encouraged to update to the latest version to mitigate these risks. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for privatebin/privatebin →
FAQ
The vulnerability is a reflected JSON injection that allows attackers to manipulate JSON responses by injecting arbitrary data.
If you are using PrivateBin version 2.0.4 or earlier, your instance is vulnerable. You can check your version in the composer.lock file.
The vulnerability can lead to unauthorized data exposure and manipulation of JSON responses, which may affect applications relying on this data.
Yes, you can use Vulert to monitor your application for open-source vulnerabilities in real-time. It requires only the composer.lock file for analysis.
The CVSS score for this vulnerability is 0.0, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for privatebin/privatebin.
