CVE-2026-129142: paicoding commit 766c48b through 903adce Stored XSS via Payment Notifications
paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author's browser when the author views notifications.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authors who view payment notifications are the execution targets. An authenticated user can trigger the issue by controlling their display name and initiating a pending payment for one of the author's paid articles.
Is user interaction required for exploitation?
Yes. The affected author must view the payment notification containing the attacker-controlled display name. The attacker also needs authenticated access to set that display name and start a pending payment.
How can I determine whether my deployment is affected?
The affected range is PaiCoding commits 766c48b through 903adce. Deployments in that range should inspect whether payment notification creation inserts payer display names without escaping and whether notification rendering uses th:utext.