{"id":"GO-2026-5804","revision":"cd5481d8727441d1b44813154992012c","records":[{"revision":"cd5481d8727441d1b44813154992012c","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5804","aliases":["CVE-2026-48788","GHSA-4c8j-mgm4-qqvp"],"title":"Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing in github.com/umputun/remark42","description":"Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing in github.com/umputun/remark42","state":0,"publishedAt":"2026-07-07T15:26:32+00:00","modifiedAt":"2026-07-07T16:01:34.7140254+00:00","affected":[{"ecosystem":"Go","name":"github.com/umputun/remark42","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.6.0"},{"kind":"fixed","version":"1.16.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/umputun/remark42/security/advisories/GHSA-4c8j-mgm4-qqvp","https://nvd.nist.gov/vuln/detail/CVE-2026-48788","https://github.com/umputun/remark42/commit/78d6de6bce1e961f023969da3ec8a00dd80c9ae8","https://github.com/umputun/remark42/releases/tag/v1.16.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5804","license":"OSV · upstream source license applies","key":"osv:GO-2026-5804","identifiers":["GO-2026-5804","CVE-2026-48788","GHSA-4c8j-mgm4-qqvp"]},"retained":false,"historicalAffected":[]}],"coverage":[]}