Stored Cross-Site Scripting Vulnerability in paicoding by itwanger
CVE-2026-129141

5.1MEDIUM

Key Information:

Vendor

Itwanger

Status
Paicoding
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129141?

The paicoding product versions 1.0.0 through 1.0.3 include a stored cross-site scripting vulnerability due to improper handling of user profile text. The SeoInjectService does not sanitize the embedded data in an inline JSON-LD script element. This flaw allows authenticated attackers to inject malicious scripts by adding a closing script tag and additional HTML into their profile text. Consequently, this enables the execution of arbitrary scripts for any user visiting the attacker's profile page, posing serious risks such as session hijacking through the theft of non-HttpOnly f-session cookies.

Affected Version(s)

paicoding 1.0.0 <= 1.0.3

References

https://vul.yulun.ac.cn/20261112/paicoding/
third-party-advisory
https://github.com/itwanger/paicoding/issues/137
issue-tracking
https://github.com/itwanger/paicoding/blob/903adce70309d3...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wu Yulun
.