Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…
EPSS 0.2%top 93%

CVE-2026-42192: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in useplunk plunk

0
Medium
VulnerabilityCVE-2026-42192cvecve-2026-42192cwe-79
Published: 05/08/2026 (05/08/2026, 21:13:25 UTC)
Source: CVE Database V5
Vendor/Project: useplunk
Product: plunk

Description

Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cross-site scripting (XSS) vulnerability exists in the campaign management feature, where the email body content created by authenticated project members is stored and later rendered in the admin dashboard using React's dangerouslySetInnerHTML without any HTML sanitization. This allows a lower-privileged member to embed malicious scripts in a campaign's email body that execute in the context of any admin or other member who views the campaign, potentially enabling session hijacking or unauthorized actions on their behalf. This issue has been patched in version 0.9.0.

CVSS v3.1

Score 5.4medium

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

GitHub Actionsmore threats →ai
useplunk/plunk
pkg:github/useplunk/plunk
Affected versions
<0.9.0

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 05/16/2026, 10:16:48 UTC

Technical Analysis

The vulnerability CVE-2026-42192 in useplunk plunk is a stored cross-site scripting (CWE-79) flaw affecting versions before 0.9.0. It arises because the email body content in campaigns is rendered using React's dangerouslySetInnerHTML without sanitization, allowing malicious script injection by authenticated but lower-privileged users. These scripts execute in the context of any admin or member who views the campaign, potentially enabling session hijacking or unauthorized actions. The issue is fixed in version 0.9.0. The product is a cloud service built on AWS SES, and the vendor manages patching server-side.

Potential Impact

Exploitation of this vulnerability allows an authenticated lower-privileged user to inject malicious scripts into campaign email bodies, which execute when viewed by admins or other members. This can lead to session hijacking or unauthorized actions performed on behalf of the victim user. There is no indication of impact on availability. The CVSS score of 5.4 reflects a medium severity impact on confidentiality and integrity.

Mitigation Recommendations

A patch addressing this vulnerability is available in useplunk plunk version 0.9.0. Since the product is a cloud-hosted service, the vendor manages remediation and patch deployment server-side. Users should ensure they are using version 0.9.0 or later to mitigate this issue. Check the vendor advisory for confirmation of patch deployment status. No additional mitigation steps are indicated by the vendor advisory.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Data Version
5.2
Assigner Short Name
GitHub_M
Date Reserved
2026-04-25T01:53:21.583Z
Cvss Version
3.1
State
PUBLISHED
Remediation Level
null
Is Cloud Service
true

Threat ID: 69fe575bcbff5d86102f610e

Added to database: 05/08/2026, 21:36:27 UTC

Last enriched: 05/16/2026, 10:16:48 UTC

Last updated: 07/31/2026, 19:22:58 UTC

Views: 88

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses