CVE-2026-82664: GEOFlow XSS Vulnerability

CVE-2026-82664 Overview

CVE-2026-82664 is a cross-site scripting (XSS) vulnerability affecting yaojingang GEOFlow versions up to and including 2.1.0. The flaw resides in the JSON-LD Theme Handler component, specifically within app/Http/Controllers/Site/HomeController.php. Manipulation of the Search argument enables reflected XSS against users of the affected site. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). It is remotely exploitable over the network but requires user interaction. A public disclosure and proof-of-concept exist, and the maintainer has released version 2.1.1 with commit 67abfd864a15d169a78429f3290c91cb3b93e849 as the fix.

Critical Impact
Attackers can inject client-side script into pages generated by the JSON-LD Theme Handler via the Search parameter, potentially hijacking sessions, defacing pages, or redirecting authenticated users.

Affected Products

yaojingang GEOFlow versions up to 2.1.0
Component: JSON-LD Theme Handler (app/Http/Controllers/Site/HomeController.php)
Fixed in: GEOFlow v2.1.1

Discovery Timeline

2026-08-31 - CVE-2026-82664 published to the National Vulnerability Database
2026-09-01 - Last updated in NVD database
Patch commit - 67abfd864a15d169a78429f3290c91cb3b93e849 merged via Pull Request #61 addressing Issue #60
Release - GEOFlow v2.1.1 published with the fix

Technical Details for CVE-2026-82664

Vulnerability Analysis

GEOFlow renders JSON-LD structured data through its theme handler in HomeController.php. When a client submits a request containing a Search argument, the application incorporates that value into the response without adequate output encoding. Because the injection point sits within a page rendered to the browser, an attacker-controlled Search value can break out of the surrounding markup or JSON context and execute JavaScript in the victim's session.

The issue is a reflected XSS pattern: the malicious payload is delivered in the request and echoed into the immediate response. Exploitation requires a victim to click or otherwise load a crafted URL. Successful exploitation runs in the origin of the vulnerable GEOFlow site, giving the attacker access to cookies, DOM contents, and any actions the victim can perform.

Root Cause

The root cause is missing or insufficient neutralization of user-controlled input before it is embedded in server-generated HTML or JSON-LD output (CWE-79). The Search parameter is trusted at the point of rendering inside the JSON-LD Theme Handler code path, allowing script content to survive to the browser.

Attack Vector

The attack vector is remote over the network with user interaction required. An attacker crafts a URL against a GEOFlow instance that includes a malicious Search value and delivers it through phishing, forum posts, or embedded links. When the victim loads the URL, the injected script executes in the browser context of the GEOFlow application.

text

// Patch context from PR #61 (environment hardening shipped alongside the XSS fix)
// Source: https://github.com/yaojingang/GEOFlow/commit/67abfd864a15d169a78429f3290c91cb3b93e849

- URL_IMPORT_ALLOW_MIXED_DNS=false
- GEOFLOW_NO_PROXY=localhost,127.0.0.1,::1,postgres,redis,host.docker.internal
+ GEOFLOW_OUTBOUND_PRIVATE_TARGETS=
+ GEOFLOW_OUTBOUND_JSON_MAX_BYTES=4194304
+ GEOFLOW_LEGACY_IMAGE_PATH_INPUT=false
+ GEOFLOW_SECURITY_FRESH_INSTALL_CONFIRMED=false

Note: The patch bundle in commit 67abfd86 primarily reworks environment configuration and outbound security defaults. Application-side sanitization for the Search parameter is applied within HomeController.php as part of the same merge; refer to the full commit diff for the controller changes.

Detection Methods for CVE-2026-82664

Indicators of Compromise

HTTP requests to GEOFlow endpoints containing a Search query parameter with <script>, javascript:, onerror=, or HTML-encoded angle brackets.
Unusual referrers linking into GEOFlow search endpoints from external domains, especially shortened URLs.
Web server logs showing repeated 200 responses to Search=-bearing requests that return oversized or unusual response bodies.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the Search parameter for XSS payload signatures and reject or sanitize them at the edge.
Enable a strict Content-Security-Policy and monitor report-uri or report-to endpoints for policy violations originating from GEOFlow pages.
Correlate anomalous outbound requests from user browsers (cookie exfiltration, unexpected fetch calls) with prior visits to GEOFlow search URLs.

Monitoring Recommendations

Tail application access logs for HomeController search requests and alert on payloads matching known XSS patterns.
Track version metadata of deployed GEOFlow instances and flag any instance still reporting a version at or below 2.1.0.
Monitor authenticated session activity for anomalous privilege actions immediately following clicks on external inbound links to GEOFlow.

How to Mitigate CVE-2026-82664

Immediate Actions Required

Upgrade GEOFlow to version 2.1.1 or later, which contains the fix in commit 67abfd864a15d169a78429f3290c91cb3b93e849.
Inventory all GEOFlow deployments and confirm the running version against the v2.1.1 release notes.
Rotate any user session cookies or authentication tokens issued before the upgrade if exposure is suspected.

Patch Information

The upstream fix is available in the GEOFlow GitHub repository via Pull Request #61, which resolves Issue #60. The patch commit hash is 67abfd864a15d169a78429f3290c91cb3b93e849. Administrators should pull the tagged release v2.1.1 rather than cherry-picking the commit to ensure all associated hardening changes are applied. Additional advisory context is available at VulDB CVE-2026-82664.

Workarounds

Deploy a WAF rule that blocks or sanitizes Search parameters containing HTML tags, script keywords, or event-handler attributes on GEOFlow endpoints.
Enforce a strict Content-Security-Policy header disallowing inline scripts and restricting script sources to trusted origins.
Restrict access to the affected GEOFlow instance to authenticated users on trusted networks until the upgrade to 2.1.1 is completed.

bash

# Upgrade GEOFlow to the patched release
git fetch --tags
git checkout v2.1.1

# Verify the fix commit is present
git log --oneline | grep 67abfd86

# Example nginx rule to block obvious XSS payloads in the Search parameter
# location / {
#     if ($arg_Search ~* "(<script|javascript:|onerror=|onload=)") {
#         return 403;
#     }
# }