Read the docs
TI-2026-22021 Aliases CVE-2026-27639

Mercator vulnerable to stored XSS via unescaped Blade directives in display templates

Priority LOW 39CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Mercator is an open source web application designed to enable mapping of information systems. A stored Cross-Site Scripting (XSS) vulnerability exists in Mercator prior to version 2026.02.22 due to the use of unescaped Blade directives (`{!! !!}`) in display templates. An authenticated user with the User role can inject arbitrary JavaScript payloads into fields such as "contact point" when creating or editing entities. The payload is then executed in the browser of any user who views the affected page, including administrators. Version 2026.02.22 fixes the vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00326 25th percentileScored 2026-11-07
Fix Fixed mercator (dbarzin): 2026.02.22

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dbarzinmercatorbefore 2026.02.222026.02.22Patch availableCNA
  • mercator Vendordbarzin Affected before 2026.02.22 Fixed in 2026.02.22 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sourcentis:mercator:*:*:*:*:*:*:*:*before 2026.02.22Vulnerablesourcentis
  • cpe:2.3:a:sourcentis:mercator:*:*:*:*:*:*:*:* Versions before 2026.02.22 Vulnerable ·sourcentis

Remediation

  • Fix · CNA mercator (dbarzin) Fixed in 2026.02.22

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27639

References

Patch 3

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences