CVE-2026-129141: paicoding 1.0.0 through 1.0.3 Stored XSS via JSON-LD Profile Description
paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user profile text without escaping in an inline JSON-LD script element. Authenticated attackers can add a closing script tag followed by HTML to their profile, executing scripts for visitors of their profile page and stealing the non-HttpOnly f-session cookie.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability and who is exposed to the resulting script execution?
An authenticated attacker who can edit their profile description can inject the payload. Visitors who view that attacker’s profile page are exposed to script execution in their browser.
What does an attacker need to do to trigger the XSS?
The attacker needs a valid account and must place a closing script tag followed by HTML in their profile text. The payload is stored and runs when another user visits the attacker’s profile page.
What is the likely impact on affected visitors?
Injected script can steal the f-session cookie when that cookie is not marked HttpOnly. The stated impact includes confidentiality and integrity effects, with scope changed.
Which versions should be investigated?
paicoding versions 1.0.0 through 1.0.3 are identified as affected. The provided data does not identify a fixed version or a workaround.