Threats affecting pkg:npm/vanblog

CVE-2026-129259 is a cross-site scripting (XSS) vulnerability in Mereithhh VanBlog versions up to 0.54.0. The flaw exists in the Image Upload Endpoint component, specifically in the file packages/server/src/types/access/access.ts. This vulnerability allows remote attackers to execute malicious scripts via crafted input. Public exploit code is available, and the vendor has not responded to disclosure attempts.