CVE-2026-92784: Refine Inferencer XSS Vulnerability

CVE-2026-92784 Overview

CVE-2026-92784 is a code injection vulnerability [CWE-94] in @refinedev/inferencer through version 7.0.0. The library fails to escape API field names when interpolating them into generated JSX source code. Attackers who control the data provider can inject malicious JavaScript through crafted JSON property names. The injected code executes in the developer's browser when the Inferencer page renders. This creates a supply chain and development-time attack surface for teams using Refine to scaffold admin panels and internal tools from remote APIs.

Critical Impact
Attackers controlling API responses can execute arbitrary JavaScript in a developer's browser session during Inferencer-driven UI generation, leading to credential theft, source code exfiltration, and pivoting into internal infrastructure.

Affected Products

@refinedev/inferencer versions through 7.0.0
Refine applications using Inferencer components (AntD, MUI, Chakra, Mantine variants)
Development environments consuming untrusted or attacker-influenced data providers

Discovery Timeline

2026-09-16 - CVE-2026-92784 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92784

Vulnerability Analysis

The Inferencer package inspects records returned by a configured data provider and generates JSX source code for list, show, edit, and create views. During code generation, field names from the API response are interpolated directly into JSX template strings without escaping. Because the generated string is subsequently evaluated as component source, any JavaScript syntax embedded in a field name becomes executable code rather than a literal identifier. The vulnerability affects the code path in packages/inferencer/src/create-inferencer/index.tsx and the per-framework inferencer templates such as packages/inferencer/src/inferencers/antd/list.tsx.

Root Cause

The root cause is missing sanitization of dynamic identifiers when constructing generated code. The inferencer treats field names as trusted identifiers even though they originate from external HTTP responses. Standard JSX interpolation does not sanitize property names that will themselves be compiled and executed, allowing an attacker-supplied string to break out of the intended identifier context.

Attack Vector

Exploitation requires an attacker to control or influence responses from the data provider a developer connects to Refine. A malicious API returns JSON with property names crafted to close the surrounding JSX expression and append arbitrary JavaScript. When the developer opens the Inferencer preview page, the generated component compiles and runs the injected payload in the browser context. Consult the VulnCheck Advisory: Code Injection and the Inferencer function code for the vulnerable interpolation path.

Detection Methods for CVE-2026-92784

Indicators of Compromise

Unexpected JSON field names in API responses containing JavaScript syntax such as backticks, curly braces, or ); sequences.
Outbound network requests from developer workstations to unknown domains shortly after loading an Inferencer preview.
Unexpected modifications to files under project src/ directories generated by the Inferencer scaffolding workflow.

Detection Strategies

Audit installed @refinedev/inferencer versions across repositories and CI pipelines using dependency scanning tools.
Inspect data provider responses for property names that do not match a strict identifier pattern such as ^[A-Za-z_][A-Za-z0-9_]*$.
Review generated JSX output for syntactically anomalous identifiers before committing scaffolded code.

Monitoring Recommendations

Monitor developer workstation egress for connections to non-approved endpoints during scaffolding activities.
Log and alert on npm or pnpm installations of @refinedev/inferencer versions at or below 7.0.0.
Track Refine GitHub Issue #7556 and the Refine project for patched release announcements.

How to Mitigate CVE-2026-92784

Immediate Actions Required

Restrict Inferencer usage to development environments connected only to trusted, first-party APIs.
Remove or gate @refinedev/inferencer from projects that consume third-party or user-controlled data providers.
Validate all API field names against a strict identifier allowlist before invoking the Inferencer.

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Monitor the VulnCheck Advisory and GitHub Issue #7556 for the coordinated fix and upgrade guidance from the Refine maintainers.

Workarounds

Wrap the data provider with a middleware layer that rejects or normalizes response keys not matching a safe identifier pattern.
Use the Inferencer only to generate initial code offline against mock fixtures, then discard the runtime dependency in production builds.
Apply Content Security Policy headers on developer preview environments to limit the impact of injected script execution.

bash

# Configuration example: reject unsafe API field names in a data provider wrapper
const SAFE_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;

function assertSafeKeys(obj) {
  for (const key of Object.keys(obj)) {
    if (!SAFE_KEY.test(key)) {
      throw new Error(`Unsafe API field name rejected: ${key}`);
    }
  }
  return obj;
}