Cross Site Scripting Vulnerability in Diem Project's Version Check Service
CVE-2026-112038

4.8MEDIUM

Key Information:

Vendor

Diem-project

Status
Diem
Vendor
CVE Published:
19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-112038?

A vulnerability has been identified in the Version Check Service of the Diem Project. This issue affects the html function within the 'dmAdminPlugin/web/js/dmAdminCtrl.js' file, allowing attackers to execute malicious scripts in the context of the affected application. Since the product adopts a rolling release development model, precise version numbers of affected or patched releases have not been specified. Although the vulnerability was reported early to the project maintainers, no response or fix has been communicated publicly, raising concerns for users regarding potential remote exploitation.

Affected Version(s)

diem 116974edfb9a5b8bd69cb13586dc62bcdbb485ad

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-112038 - Proof of Concept

References

https://vuldb.com/vuln/421686
vdb-entrytechnical-description
https://vuldb.com/vuln/421686/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-112038
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

gscsd (VulDB User)
VulDB CNA Team
.