Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-92784

@refinedev/inferencer through 7.0.0 Code Injection via API Field Names

CVSS 4.0 7.7 HIGHCVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-92784

Published

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-92784

Published

@refinedev/inferencer

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "refinedev",
                    "product": "@refinedev/inferencer",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:npm/%40refinedev/inferencer",
                    "versions": [
                        {
                            "version": "0",
                            "lessThanOrEqual": "7.0.0",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON