CVE-2026-3041 Details
Description
A security vulnerability has been detected in xingfuggz BaykeShop up to 1.3.20. Impacted is an unknown function of the file src/baykeshop/contrib/article/templates/baykeshop/sidebar/custom.html of the component Article Sidebar Module. Such manipulation of the argument sidebar.content leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A stored cross-site scripting vulnerability has been identified in Xingfuggz BaykeShop versions through 1.3.20. The issue resides in the Article Sidebar Module, specifically within the file 'src/baykeshop/contrib/article/templates/baykeshop/sidebar/custom.html'. The vulnerability is caused by the 'sidebar.content' field being rendered without proper escaping, allowing attackers to inject arbitrary HTML or JavaScript. This injected content is then executed in the browsers of all visitors who view the affected sidebar.
The immediate fix is to remove the '|safe' filter from the sidebar content rendering and use Django's default auto-escaping. If the sidebar is meant to contain safe HTML, implement a strict HTML sanitizer like Bleach or django-bleach to allow only safe tags and attributes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 23, 2026CISA-ADP
Assessed Feb 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xingfuggz/baykeShop/ | [email protected] | ProductSource CodeVendor |
| https://github.com/xingfuggz/baykeShop/issues/1 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/xingfuggz/baykeShop/issues/1#issue-3931488211 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/?ctiid.347397 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/?id.347397 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/?submit.757165 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| xingfuggz BaykeShop | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Feb 23, 2026 | New CVE Received | [email protected] |