Cross Site Scripting Vulnerability in RethinkDB by RethinkDB Inc.
CVE-2026-1520

4.8MEDIUM

Key Information:

Vendor

RethinkDB Inc.

Status
Rethinkdb
Vendor
CVE Published:
28 January 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-1520?

A noteworthy vulnerability exists in the Secondary Index Handler of RethinkDB, affecting all versions up to 2.4.3. This flaw allows for remote exploitation through cross site scripting (XSS), enabling attackers to manipulate data and execute malicious scripts in the context of the user's session. Although the vendor was informed about this vulnerability, there has been no response, and proof-of-concept exploits are publicly accessible, amplifying the urgency for users to secure their systems against potential attacks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

rethinkdb 2.4.0

rethinkdb 2.4.1

rethinkdb 2.4.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-1520 - Proof of Concept

References

https://vuldb.com/?id.343191
vdb-entry
https://vuldb.com/?ctiid.343191
signaturepermissions-required
https://vuldb.com/?submit.738312
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

59lab (VulDB User)
JSON
.