CVE-2026-92784 @refinedev/inferencer through 7.0.0 Code Injection via API Field Names
Attackers controlling the data provider can inject malicious JavaScript into generated code, executing it in the developer's browser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-92784?
CVE-2026-92784 is a high-severity code injection vulnerability in @refinedev/inferencer, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders.
Weakness: CWE-94
Which versions are affected by CVE-2026-92784?
How do I fix CVE-2026-92784?
No fix has been published for CVE-2026-92784 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-92784 being exploited?
There is no known exploitation of CVE-2026-92784 in the wild and no public exploit code.
Sources
Also known as GHSA-x4x4-phr8-wp7p.