Reflected cross-site scripting in wrensec-commons CREST HTTP binding
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
wrensec-commons from 0 before 22.6.2 and from 23.0.0-M1 before 23.0.0 contains a reflected cross-site scripting flaw in the CREST framework HTTP binding. The HttpUtils.prepareResponse() method sets the Content-Type response header from the _mimeType request parameter without sanitization (CWE-79). An unauthenticated remote attacker can make a browser render a CREST JSON response as HTML by tricking a user into visiting a crafted URL for any deployed CREST endpoint, which runs arbitrary JavaScript in the victim's browser.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Wren Security | wrensec-commons | before 22.6.2; 23.0.0-M1 to before 23.0.0 | 22.6.2, 23.0.0 | Patch available | CNA |
- wrensec-commons VendorWren Security Affected before 22.6.2; 23.0.0-M1 to before 23.0.0 Fixed in 22.6.2, 23.0.0 Patch available CNA
Remediation
Upgrade wrensec-commons to version 22.6.2 or 23.0.0. The sources list no fixed version for other branches.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA wrensec-commons (Wren Security) Fixed in 22.6.2, 23.0.0
Timeline
- 2026-11-02 Threatist record created from CVE-2026-2102
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-02 Priority changed: MEDIUM → LOW
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences