https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T20:55:08.420152+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-222084 EUVD-2026-222084 2026-10-02T20:55:08.482515+00:00 EUVD-2026-222084 https://cve.radiocsirt.org/vuln/fkie_cve-2024-52812 fkie_cve-2024-52812 2026-10-02T20:55:08.482560+00:00

LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule `id` parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim's browser. Version 2.0.8 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-6hrw-x7pr-4mp8 GHSA-6hrw-x7pr-4mp8 — LF Edge eKuiper allows Stored XSS in Rules Functionality 2026-10-02T20:55:08.482598+00:00

Affected: Go: github.com/lf-edge/ekuiper/v2, Go: github.com/lf-edge/ekuiper

### Summary Stored Cross-Site Scripting (XSS) vulnerability allows attackers to inject malicious scripts into web applications, which can then be executed in the context of other users' browsers. This can lead to unauthorized access to sensitive information, session hijacking, and spreading of malware, impacting user data privacy and application integrity.

### Details

A user with rights to modificate the service (e.g. kuiperUser role) can inject XSS Payload into Rule `id` parameter. Then, after any user with access to this service (e.g. admin) will try make any modifications with the rule (update, run, stop, delete), a payload will act in victim's browser.

The issue appears as the notification to user is made in an insafe way:

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824

Such writing to 'http.ResponseWriter' bypasses HTML escaping that prevents cross-site scrip…

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14893-1 openSUSE-SU-2025:14893-1 — govulncheck-vulndb-0.0.20250313T170021-1.1 on GA media 2026-10-02T20:55:08.482650+00:00

govulncheck-vulndb-0.0.20250313T170021-1.1 on GA media