CVE-2026-45231 is a stored cross-site scripting vulnerability in DumbWareio's DumbAssets product affecting versions up to 1.0.11. The flaw exists because asset fields such as name, description, modelNumber, serialNumber, and tags are stored without server-side sanitization and rendered using innerHTML without escaping on the client side. Attackers can exploit this by creating or updating assets through the API with malicious scripts that execute in users' browsers when viewing the asset list. The lack of Content-Security-Policy enforcement can further enable these scripts to perform unrestricted network requests internally. No official remediation or patch has been indicated in the available data.

Successful exploitation allows attackers to execute arbitrary scripts in the browsers of users who view the affected asset data. This can lead to theft of session tokens, unauthorized actions on behalf of users, or network reconnaissance if Content-Security-Policy is disabled. The vulnerability does not require privileges or authentication to exploit and has a medium severity rating based on CVSS 4.0 scoring.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider enabling strict Content-Security-Policy headers to restrict script execution and network requests. Additionally, avoid disabling client-side security controls and monitor API usage for suspicious asset creation or updates containing HTML or JavaScript payloads.