CVE-2026-111405: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in PT Norther Lights Production MapSVG

This vulnerability in MapSVG allows an attacker with low privileges and requiring user interaction to inject malicious scripts that are stored and later executed in the context of affected users. The issue arises from improper sanitization of input during web page generation, enabling stored cross-site scripting. The affected versions include all releases prior to 8.16.2.

Successful exploitation can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). This means an attacker could potentially execute arbitrary scripts in the victim's browser, leading to data theft, session hijacking, or disruption of service within the scope of the application.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using affected versions or apply any vendor-recommended mitigations once published.