This vulnerability involves inconsistent interpretation of HTTP requests (CWE-444) in CoreBunch Instatic through version 0.0.14. An attacker can exploit the GET /_instatic/hole/<nodeId> endpoint by crafting the u query parameter, which seeds the route template frame used for rendering. Because the render cache is shared process-wide and keyed only by nodeId, the attacker can poison this cache with malicious content. As a result, all subsequent visitors to that nodeId receive malformed or attacker-controlled fragment content.

An unauthenticated remote attacker can poison the shared render cache, causing all users accessing the affected nodeId to receive attacker-controlled or malformed content fragments. This can lead to partial content manipulation and potential information integrity issues. The CVSS 3.1 base score is 6.1 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a patch is available, restrict access to the vulnerable endpoint if possible or implement application-level filtering to validate and sanitize the u query parameter to reduce risk.