CVE-2026-112039: Cross Site Scripting in diem-project diem

This vulnerability exists in the append function of the dmAdminPlugin/modules/dmConsole/actions/actions.class.php file within the Administrative Console component of diem-project diem. The dm_command argument can be manipulated to inject malicious scripts, leading to cross-site scripting. The attack can be performed remotely without user interaction but requires high privileges. The project follows a rolling release model, so exact affected versions are not specified. The vendor has been informed but has not responded or issued a fix. Exploit code has been publicly disclosed.

Successful exploitation allows remote attackers with high privileges to execute cross-site scripting attacks via the dm_command parameter in the Administrative Console. This could lead to script execution in the context of the affected application, potentially impacting users interacting with the console. The vulnerability does not involve privilege escalation, confidentiality, or integrity violations beyond the XSS impact as described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, restrict access to the Administrative Console to trusted users and consider implementing web application firewall (WAF) rules to detect and block XSS payloads targeting the dm_command parameter.