CVE-2026-92784 Details
Description
@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders.
A code injection vulnerability has been identified in the @refinedev/inferencer package, affecting versions through 7.0.0. The issue arises because the tool fails to properly escape API field names when generating JSX code. This flaw allows attackers to inject malicious JavaScript by crafting specific JSON property names. The injected code executes in the developer's browser as soon as the Inferencer page is rendered, without any user interaction or confirmation.
Users can update to the latest version of @refinedev/inferencer, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/refinedev/refine | [email protected] | Vendor |
| https://github.com/refinedev/refine/blob/main/packages/inferencer/src/create-inferencer/index.tsx#L117-L128 | [email protected] | Source CodeVendor |
| https://github.com/refinedev/refine/blob/main/packages/inferencer/src/inferencers/antd/list.tsx#L140-L144 | [email protected] | Source CodeVendor |
| https://github.com/refinedev/refine/issues/7556 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/refinedev-inferencer-through-7.0.0-code-injection-via-api-field-names | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Refinedev Inferencer | <= 7.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |