CVE-2026-17528
MEDIUMnice-select2 < 2.4.1 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Title source: ruleDescription
Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary script execution in a victim’s browser when they view or interact with the affected page.
Scores
CVSS v3
6.1
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
None/nice-select2
< 2.4.1
Published
Jul 28, 2026
Tracked Since
Jul 28, 2026