CVE-2026-43939 YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers
Attackers can inject malicious JavaScript into forum posts, executing arbitrary code in the browsers of all users viewing the thread.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-43939?
CVE-2026-43939 is a high-severity cross-site scripting vulnerability in YAFNET, published on 12 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature accepts user-supplied content via a a post or reply that is stored server-side and later rendered back into the thread page without adequate HTML sanitization or contextual output encoding. This vulnerability is fixed in 4.0.5 and 3.2.12.
Which versions are affected by CVE-2026-43939?
4 open source packages ship an affected version, including YAFNET.Core.
| Package | Affected | Fixed in |
|---|---|---|
YAFNET.Core NuGet | All versions | 3.2.12 |
YAFNET.Core NuGet | All versions | 3.2.12 |
YAFNET.Core NuGet | From 4.0.0-beta01 | 4.0.5 |
YAFNET.Core NuGet | From 4.0.0-beta01 | 4.0.5 |
How do I fix CVE-2026-43939?
Upgrade YAFNET.Core to a fixed version for your release line: 3.2.12 or 4.0.5.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-43939 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43939 exists.
Sources
Also known as GHSA-8rq5-wwpp-fmj2.