CVE-2026-95812 ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters
Attackers can execute arbitrary JavaScript in victims' browsers via unsanitized query parameters in ClipBucket v5.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-95812?
CVE-2026-95812 is a medium-severity cross-site scripting vulnerability in MacWarrior clipbucket-v5, published on 22 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.
Weakness: CWE-79
Which versions are affected by CVE-2026-95812?
How do I fix CVE-2026-95812?
No fix has been published for CVE-2026-95812 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-95812 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-95812 exists.
Sources
Also known as GHSA-4vrg-2v5w-7r99.