CVE-2026-2102 Details
Description
wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0.
A reflected cross-site scripting vulnerability has been identified in the Wren Security wrensec-commons library, specifically within the CREST framework's HTTP binding. This issue arises because the HttpUtils.prepareResponse() method improperly sanitizes the _mimeType request parameter before using it to set the Content-Type response header. As a result, an attacker can send a GET request with _mimeType=text/html, causing the browser to misinterpret a CREST JSON response as HTML. This flaw enables the execution of arbitrary JavaScript in the victim's browser. Exploitation requires tricking the user into clicking a crafted URL that targets any active CREST endpoint.
The vulnerability has been patched in Wren Security wrensec-commons versions 22.6.2 and 23.0.0. Users should upgrade to these versions to address the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WrenSecurity/wrensec-commons/commit/5b50c64c14943b6f4d7faf996345e603956bae1d | b6ef82d7-f637-461b-aedd-74f5857d5f5b | Source CodeVendor |
| https://github.com/WrenSecurity/wrensec-commons/commit/65bbfd8c63c42e84ff7699aa5b82a22c08a12624 | b6ef82d7-f637-461b-aedd-74f5857d5f5b | Source CodeVendor |
| https://github.com/WrenSecurity/wrensec-commons/security/advisories/GHSA-4vhv-49g2-496q | b6ef82d7-f637-461b-aedd-74f5857d5f5b | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | b6ef82d7-f637-461b-aedd-74f5857d5f5b |
Affected Products
| Product | Versions |
|---|---|
| WrenSecurity wrensec-commons | < 22.6.2 (semver) >= 23.0.0-M1, < 23.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | b6ef82d7-f637-461b-aedd-74f5857d5f5b |