Cross-User HTML Injection in Part-DB Inventory Management System
CVE-2026-55600

5.7MEDIUM

Key Information:

Vendor

Part-db

Status
Part-db-server
Vendor
CVE Published:
23 October 2026

What is CVE-2026-55600?

Part-DB, an open source inventory management system for electronic components, contains a vulnerability prior to version 2.12.2 that allows for cross-user stored HTML injection. The issue stems from the rendering of BOM validation messages using Twig's |raw filter, which processes user-controlled Part names that may include HTML markup. When another user imports a BOM CSV with the maliciously altered Part ID, the Part name can lead to unintended HTML rendering on their validation results page. While the Content Security Policy restricts JavaScript execution, it does not prevent the inclusion of arbitrary HTML elements, links, images, and CSS-based UI components, potentially compromising the integrity of trusted Part-DB pages. This vulnerability has been addressed in the latest release, version 2.12.2.

Affected Version(s)

Part-DB-server < 2.12.2

References

https://github.com/Part-DB/Part-DB-server/security/adviso...
x_refsource_CONFIRM
https://github.com/Part-DB/Part-DB-server/releases/tag/v2...
x_refsource_MISC

CVSS V4

Score:
5.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.