CVE-2026-92991: Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
The Biggop Library is vulnerable to Cross-Site Scripting via the ‘displayid’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
The attacker must be able to compromise the Sigmative API server and supply a malicious value through the display_id parameter. The vulnerability is not described as exploitable solely through direct interaction with the affected site.
Who is exposed to the injected script?
Users who access a page containing the attacker-injected content may execute the arbitrary script in their browser. The available data does not identify specific affected versions beyond describing them as various versions.
What can be done if patching is not immediately possible?
Protect access to and monitor the Sigmative API server, since compromise of that server is the stated prerequisite for injection. Review API-provided display_id values for unexpected or script-like content before they are rendered.