Threats affecting pkg:npm/forocoches/comments-editor

CVE-2026-14467 is an information disclosure vulnerability in the Forocoches comments editor. It allows an attacker to embed an image with a malicious external URL in a comment. When users view the affected discussion thread, their browsers send HTTP/HTTPS requests to the attacker's server, leaking sensitive metadata such as IP address, User-Agent, and access time. This compromises user privacy. The vulnerability affects version 0 of the Forocoches comments editor and has a high severity score of 8.2. A fix was released in May 2026.