Cross-Site Request Forgery Vulnerability in nliautaud pico-content-editor
CVE-2026-122144

5.3MEDIUM

Key Information:

Vendor

Nliautaud

Status
Pico-content-editor
Vendor
CVE Published:
5 November 2026

What is CVE-2026-122144?

A security flaw has been identified in the nliautaud pico-content-editor that exposes users to potential Cross-Site Request Forgery (CSRF) attacks. This vulnerability affects all versions up to 02d5ad6c820c5050c542ab9505819b5e0a0ba1af, allowing attackers to exploit the system remotely. It is particularly concerning as the affected product relies on a rolling release strategy, meaning users may not receive timely updates or alerts about security issues. The maintainer of this product has not disclosed any version information or responded to reports, raising concerns for users relying on unsupported versions.

Affected Version(s)

pico-content-editor 02d5ad6c820c5050c542ab9505819b5e0a0ba1af

References

https://vuldb.com/vuln/431149
vdb-entry
https://vuldb.com/vuln/431149/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-122144
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

vinniboy021 (VulDB User)
VulDB CNA Team
.