CVE-2026-55600: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Part-DB Part-DB-server

The vulnerability in Part-DB-server (CVE-2026-55600) is a stored cross-site scripting (CWE-79) issue affecting versions prior to 2.12.2. Part names, which can be edited by users, are inserted into BOM validation messages using Twig's |raw filter without sanitization. This allows an attacker with edit privileges on Part names to inject arbitrary HTML markup. When another user imports a BOM CSV referencing the malicious Part ID, the injected HTML is rendered in the victim's BOM validation page. Although the Content Security Policy prevents JavaScript execution, the injected HTML can include links, forms, images, and CSS-based UI elements, potentially misleading users or causing UI manipulation. The issue is resolved by patching in version 2.12.2.

An attacker with permission to edit Part names can inject arbitrary HTML content into the BOM validation result page viewed by other users. While JavaScript execution is blocked by the Content Security Policy, the injected HTML elements can still alter the page's appearance or behavior, potentially leading to phishing or UI manipulation attacks. This affects the integrity and trustworthiness of the Part-DB-server user interface for affected versions.

Upgrade Part-DB-server to version 2.12.2 or later, where this vulnerability is patched. No additional mitigation is required as the fix properly neutralizes user input in Part names before rendering.