CVE-2026-92784: @refinedev/inferencer through 7.0.0 Code Injection via API Field Names
@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Developers using @refinedev/inferencer through version 7.0.0 are exposed when an Inferencer page renders data whose API field names are controlled by an attacker. The malicious code executes in the developer's browser.
What does an attacker need to exploit it?
An attacker needs control over the data provider or its JSON response property names. Exploitation also requires a developer to render the affected Inferencer page, so user interaction is required.
What is the potential impact?
Crafted JSON property names can inject and execute malicious JavaScript in the developer's browser. The reported impact includes compromise of confidentiality, integrity, and availability.