CVE-2026-85541: CWE-79 Improper Neutralization of Input During Web Page Generation in Interinfo DreamMaker

CVE-2026-85541 is a reflected cross-site scripting vulnerability in Interinfo DreamMaker. Authenticated remote attackers can exploit this flaw by crafting malicious websites that execute arbitrary JavaScript code in the context of the victim's browser session. The vulnerability arises from improper neutralization of input during web page generation, classified under CWE-79. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required but user interaction needed, and limited scope and impact on confidentiality, integrity, and availability.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, unauthorized actions, or information disclosure within the affected application session. The impact is limited by the requirement for authentication and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted links and consider limiting authenticated user exposure to untrusted content. Monitor vendor communications for updates on patches or mitigations.