Back to overview

CVE-2026-32822

MEDIUM
6.1
CVSS 3.1
Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthenticated attacker can place arbitrary HTML into flash notifications on public routes and rely on the frontend toast component to inject that content into the DOM with `innerHTML`. This creates a reflected DOM XSS that can be delivered with a crafted link to a public page such as `/docs`. Because the vulnerable JavaScript is loaded by the normal application layout, the issue is not limited to a special debug page or an isolated admin-only view.

Metadata

CVE ID
CVE-2026-32822
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-03-16 17:35 UTC
Published
2026-07-20 15:34 UTC
Last updated
2026-07-20 17:40 UTC
Primary CWE
CWE-80
CWE-80: Improper Neutralization of Script-Related HTML Tags …
Vendor / Product
datacycle-engine / dataCycle-CORE
Sources
cve.org  ·  NVD

Severity & Metrics

6.1 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
datacycle-engine dataCycle-CORE — <= 25.07.3
Weakness (CWE)
CWESourceDescription
CWE-80 cna CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVSS scores (1)
ScoreSeverityVersionSourceVector
6.1 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References (1)
Back to overview