CVE-2026-17528: nice-select2 XSS Vulnerability

CVE-2026-17528 Overview

CVE-2026-17528 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the nice-select2 JavaScript package in versions prior to 2.4.1. The library renders option text from a <select> element directly into the Document Object Model (DOM) using template literals without sanitization. An attacker who controls option content can inject a payload that executes arbitrary JavaScript in a victim's browser when the affected page is viewed or interacted with.

Critical Impact
Successful exploitation enables arbitrary script execution in the victim's browser context, allowing session token theft, credential harvesting, and unauthorized actions on behalf of the user.

Affected Products

nice-select2 versions prior to 2.4.1
Web applications embedding vulnerable nice-select2 builds
Downstream npm consumers of the bluzky/nice-select2 package

Discovery Timeline

2026-07-28 - CVE-2026-17528 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-17528

Vulnerability Analysis

The nice-select2 library replaces native <select> elements with a stylized dropdown built from the source options. When constructing the currently-selected display span, the library concatenates option text into an HTML string using a JavaScript template literal. Because the value is inserted as raw HTML rather than as text content, any markup or <script>-equivalent payload contained in an option label is parsed by the browser as HTML. This produces a stored or reflected XSS condition depending on how the underlying <select> is populated. The vulnerability affects any deployment where option content is influenced by untrusted input, including user profile fields, search filters, and administrative dashboards that render server-supplied option values.

Root Cause

The root cause is unsafe DOM construction in src/js/nice-select2.js. The vulnerable code path built the selected-item span with selectedHtml += \${text}`, interpolating attacker-controlled text` directly into an HTML fragment. No escaping or sanitization is applied before the string is inserted into the DOM.

Attack Vector

Exploitation requires the attacker to influence option text within a <select> element that is later enhanced by nice-select2. User interaction is required, such as viewing the page or opening the dropdown. Delivery vectors include stored data rendered into select options, URL parameters reflected into option labels, or third-party data feeds populating dropdown content.

javascript

// Security patch in src/js/nice-select2.js (fix for issue #97)
            text += `, `;
          }

-          selectedHtml += `<span class="current">${text}</span>`;
+          let span  = document.createElement("span");
+          span.classList.add("current");
+          span.textContent = text;
+
+          selectedHtml += span.outerHTML;
        });

        selectedHtml = selectedHtml || this.placeholder;

Source: GitHub Commit ea23ff4. The patch replaces string interpolation with document.createElement and textContent assignment, ensuring the browser treats the value as text rather than HTML.

Detection Methods for CVE-2026-17528

Indicators of Compromise

Unexpected <script> tags or event-handler attributes appearing inside <span class="current"> elements in served HTML or rendered DOM snapshots.
Outbound browser requests to unfamiliar domains originating from pages that instantiate nice-select2.
Client-side error logs referencing script execution or Content Security Policy (CSP) violations tied to inline handlers on dropdown elements.

Detection Strategies

Inventory front-end dependencies with Software Composition Analysis (SCA) tools to flag nice-select2 versions below 2.4.1.
Audit application inputs that feed <select> option values and search for HTML metacharacters that were not sanitized before rendering.
Run Dynamic Application Security Testing (DAST) with XSS payload libraries targeting form fields whose values populate dropdowns.

Monitoring Recommendations

Enable and monitor CSP violation reporting to catch inline script execution attempts on pages containing dropdowns.
Review web server and Web Application Firewall (WAF) logs for XSS probe patterns targeting endpoints that render select controls.
Alert on anomalous JavaScript network calls or DOM mutations observed by browser-based Real User Monitoring (RUM) telemetry.

How to Mitigate CVE-2026-17528

Immediate Actions Required

Upgrade nice-select2 to version 2.4.1 or later across all applications and build pipelines.
Identify indirect dependencies pulling in vulnerable versions by running npm ls nice-select2 and updating lockfiles.
Sanitize any server-side data that populates <select> option text before it reaches the client.

Patch Information

The fix is committed in ea23ff404e186f6e2a64a25c530f93165fd2ad26 and released in nice-select22.4.1. See the GitHub commit, the issue discussion, and the Snyk advisory for full details.

Workarounds

Apply a strict CSP that disallows inline scripts and restricts script sources to trusted origins.
HTML-encode all option text on the server before rendering the <select> element to the browser.
Temporarily replace nice-select2 with the native <select> control on pages that render untrusted option data until upgrade is possible.

bash

# Upgrade nice-select2 to a patched release
npm install nice-select2@^2.4.1
npm ls nice-select2
npm audit --production