CVE-2026-1520

LOW

RethinkDB <2.4.3 - XSS

Title source: llm

Description

A vulnerability was identified in rethinkdb up to 2.4.3. Affected by this issue is some unknown functionality of the component Secondary Index Handler. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5

Core References

Permissions Required, VDB Entry vdb-entry

https://vuldb.com/?id.343191

Permissions Required, VDB Entry signature permissions-required

https://vuldb.com/?ctiid.343191

Permissions Required, VDB Entry third-party-advisory

https://vuldb.com/?submit.738312

Various Sources related

https://github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20rethinkdb%20database.md

View Writeup ZIP pw:eip

Various Sources exploit

https://github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20rethinkdb%20database.md#poc

View Writeup ZIP pw:eip

Scores

CVSS v3 2.4

EPSS 0.0004

EPSS Percentile 12.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79 CWE-94

Status published

Products (4)

n/a/rethinkdb 2.4.0

n/a/rethinkdb 2.4.1

n/a/rethinkdb 2.4.2

n/a/rethinkdb 2.4.3

Published Jan 28, 2026

Tracked Since Feb 18, 2026