CVE-2026-102667 is a critical security vulnerability in Joyland.ai where an attacker on the same network can inject JavaScript into WebView content. This exposed dangerous method or function (CWE-749) enables unauthorized access to clipboard data, arbitrary HTTP requests via the Weex 'stream' module, and internal app storage. With previously granted permissions, the attacker can escalate access to the entire file system, camera, microphone, and GPS tracking. The vulnerability affects all versions of the product and has a CVSS 4.0 score of 9.0, indicating high impact and exploitability without user interaction or privileges.

An attacker with network access can exploit this vulnerability to execute JavaScript in the app's WebView context, leading to unauthorized data access and control over device features if permissions are granted. This includes clipboard theft, arbitrary network requests, and access to sensitive device hardware and storage, potentially compromising user privacy and device security.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to trusted environments and monitor for suspicious activity related to WebView content injection.