CVE-2026-126814: blueprintUE Self-Hosted Edition before 4.3.6 Arbitrary Iframe Embedding via PeerTube Matcher
blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in BlueprintService::findVideoProvider(). Attackers can set a blueprint video URL on an attacker-controlled host, which site.js loads in an unsandboxed iframe after consent, framing fake login forms or malware downloads.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it by setting a blueprint video URL that is hosted on an attacker-controlled server. Exploitation also requires a victim to interact with the embedded content after the site presents consent.
What is the impact on users who view a malicious blueprint?
The application can load arbitrary third-party content in an unsandboxed iframe. An attacker could use this to present fake login forms or malware download prompts within the site.
Which deployments are affected?
blueprintUE Self-Hosted Edition versions before 4.3.6 are affected. The issue is specifically tied to the PeerTube video URL matching logic in BlueprintService::findVideoProvider().