CVE-2026-45231: DumbAssets Stored XSS Vulnerability

CVE-2026-45231 Overview

CVE-2026-45231 is a stored cross-site scripting (XSS) vulnerability in DumbAssets through version 1.0.11. The flaw exists in asset fields including name, description, modelNumber, serialNumber, and tags. The application stores these values without server-side sanitization and renders them with innerHTML without client-side escaping. Attackers can submit HTML or JavaScript payloads through the asset API endpoints. When other users view the asset list, the injected scripts execute in their browsers. With Content-Security-Policy disabled, the injected scripts can also make unrestricted connections to internal network services. The weakness is classified as [CWE-79].

Critical Impact
Authenticated or anonymous attackers can inject persistent JavaScript into asset records, execute scripts in victim browsers, and pivot to internal network services when CSP is not enforced.

Affected Products

DumbAssets through version 1.0.11
DumbWareio DumbAssets asset management application
Deployments rendering asset fields via innerHTML without escaping

Discovery Timeline

2026-05-18 - CVE-2026-45231 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-45231

Vulnerability Analysis

The vulnerability is a stored XSS issue in the DumbAssets asset management workflow. Asset records accept free-form string fields including name, description, modelNumber, serialNumber, and tags. The server persists these values verbatim. The front-end then injects the stored values into the DOM using innerHTML. Because neither layer applies HTML encoding, any markup contained in the stored value becomes active content. An attacker who can call the asset API endpoints can place a payload that fires for every user who later loads the asset list. The execution context is the application origin, which exposes session cookies, CSRF tokens, and authenticated API access to the attacker script.

Root Cause

The root cause is missing output encoding combined with unsafe DOM APIs. Server code skips input sanitization on asset string fields. Client code uses innerHTML rather than textContent or a templating engine that escapes by default. Either control would block the attack; both are absent.

Attack Vector

An attacker sends a crafted POST or PUT request to the asset API with a payload such as a <script> tag or an event handler attribute inside name or description. The record is stored. When any user loads the asset list view, the payload executes. With Content-Security-Policy disabled in the default deployment, the script can issue fetch or XMLHttpRequest calls to internal hosts reachable from the victim browser, enabling internal reconnaissance and pivoting beyond the application boundary.

// No verified public exploit code is available.
// See the VulnCheck advisory and the upstream pull request for technical details.

Detection Methods for CVE-2026-45231

Indicators of Compromise

Asset records containing HTML tags, <script> elements, or on* event handler attributes in fields such as name, description, modelNumber, serialNumber, or tags.
Outbound browser requests from the DumbAssets application origin to internal IP ranges that do not match normal application behavior.
Anomalous POST or PUT requests to the asset API containing URL-encoded <, >, or javascript: substrings in payload bodies.

Detection Strategies

Scan the DumbAssets database for asset fields whose values contain <, >, script, onerror, or onload substrings.
Inspect web server access logs for asset API requests with payloads matching known XSS patterns.
Review browser security telemetry for blocked or anomalous script execution on pages served by the DumbAssets origin.

Monitoring Recommendations

Enable Content-Security-Policy with a strict script-src directive and alert on CSP violation reports.
Forward web application logs and CSP reports to a centralized logging or SIEM platform for correlation.
Monitor egress from user workstations to internal services initiated by browser sessions tied to the DumbAssets origin.

How to Mitigate CVE-2026-45231

Immediate Actions Required

Upgrade DumbAssets to a release later than 1.0.11 that includes the fix from upstream pull request DumbAssets PR #135.
Audit existing asset records for stored HTML or JavaScript payloads and sanitize or delete affected entries.
Restrict network access to the DumbAssets instance to trusted users until patching is complete.

Patch Information

The upstream project addresses the issue in DumbAssets Pull Request #135. Additional technical context is published in the VulnCheck Security Advisory. Apply the fixed release and redeploy the application.

Workarounds

Enable a strict Content-Security-Policy header that disallows inline scripts and restricts connect-src to required origins.
Place the application behind a web application firewall configured to block HTML and JavaScript payloads in asset field parameters.
Limit asset creation and update permissions to a minimal set of trusted accounts.

bash

# Example strict Content-Security-Policy header for DumbAssets
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; connect-src 'self'; frame-ancestors 'none'";