This vulnerability (CVE-2026-56747) in Cribl Stream arises from improper control of code generation (CWE-94) in the JSON Pointer-to-accessor compiler. A remote attacker who is authenticated and has edit privileges can exploit this flaw by crafting a malicious database connection identifier or pack configuration value, leading to arbitrary JavaScript execution on the server. The issue affects versions prior to 4.18.2. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated user with edit privileges to execute arbitrary JavaScript code on the server hosting Cribl Stream. This could lead to unauthorized actions, data manipulation, or further compromise of the system. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict edit privileges to trusted users only and monitor for suspicious activity related to database connection identifiers or pack configurations. No vendor advisory or patch links are currently available.