CVE-2026-103846: Dimension | Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) (CWE-79)
Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
The issue requires a local attacker with user permissions and a victim who runs the application. It is therefore most relevant on systems where an attacker can execute actions locally under a user-level account.
Does exploitation require user interaction?
Yes. A victim must run the application for exploitation to occur.
What level of access does an attacker need?
The attacker needs local access and user permissions. No higher privilege requirement is stated in the available information.
What could a successful exploit allow?
Successful exploitation could result in arbitrary code execution in the context of the current user, with high impacts to confidentiality, integrity, and availability.