CVE-2026-105289: Cross Site Scripting in feelec-yishu feelcrm-os

The vulnerability CVE-2026-105289 affects feelcrm-os 1.0.0 in the htmlspecialchars_decode function of the Create Customer Endpoint. By manipulating the customer_form[remark] parameter, an attacker can perform a cross-site scripting attack remotely. This allows injection of malicious scripts that could be executed in the context of a victim's browser. The vulnerability is publicly known and exploitable, but no official fix or patch has been released by the vendor as of the publication date.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other malicious actions performed on behalf of the victim user. The vulnerability requires no privileges and can be triggered remotely, increasing its risk. However, the impact is limited to the scope of XSS and does not include direct system compromise.

No official patch or fix has been released by the vendor yet. Users should monitor the vendor's communications for updates. In the meantime, applying web application firewall (WAF) rules to detect and block malicious input targeting the customer_form[remark] parameter may help mitigate exploitation. Avoiding use of the affected feature or sanitizing inputs at the application layer could reduce risk until a vendor fix is available.