CVE-2026-39642 is a CWE-80 (Improper Neutralization of Script-Related HTML Tags) vulnerability affecting SpabRice Nyla versions up to 1.7. It allows an attacker to inject script code into web pages due to insufficient sanitization of HTML tags, resulting in basic cross-site scripting (XSS). The CVSS 3.1 score is 5.3, reflecting a network attack vector with low complexity, no privileges required, and no user interaction needed. The impact is limited to confidentiality loss, with no integrity or availability impact reported. No patch or official remediation has been disclosed by the vendor, and no known exploits exist in the wild.

The vulnerability enables an attacker to inject malicious scripts into web pages served by SpabRice Nyla, potentially leading to limited confidentiality breaches such as information disclosure. There is no reported impact on integrity or availability. Since no known exploits are reported, the immediate risk is moderate but could increase if exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently available, users should monitor SpabRice advisories closely. Implementing web application firewalls (WAFs) that detect and block XSS payloads may provide temporary mitigation. Avoid using affected versions in high-risk environments until a patch is released.