Reflected Cross-Site Scripting Vulnerability in WrenSecurity's CREST Framework
CVE-2026-2102

6.1MEDIUM

Key Information:

Vendor: Wren Security
Status: Wrensec-commons
Vendor: CVE Published:; 2 November 2026

🔔 Create Wren Security Vulnerability Alert

What is CVE-2026-2102?

The WrenSecurity CREST framework has a reflected cross-site scripting vulnerability due to improper sanitization of the _mimeType request parameter within the HttpUtils.prepareResponse() method. An attacker can exploit this issue by crafting a malicious URL that sets _mimeType to text/html, resulting in the browser executing arbitrary JavaScript under the context of the victim's session. This can lead to unauthorized access to sensitive information or actions on behalf of the user. The vulnerability affects all deployed CREST endpoints and is addressed in versions 22.6.2 and 23.0.0.