CVE-2026-9519

Summary

A security flaw has been discovered in stonith404 pingvin-share up to 1.13.0. This affects the function getServerSideProps of the file frontend/src/pages/auth/signIn.tsx of the component Sign-in Auto-Redirect. The manipulation of the argument redirect results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

VendorProductVersion RangeStatus
stonith404pingvin-share1.0affected
stonith404pingvin-share1.1affected
stonith404pingvin-share1.2affected
stonith404pingvin-share1.3affected
stonith404pingvin-share1.4affected
stonith404pingvin-share1.5affected
stonith404pingvin-share1.6affected
stonith404pingvin-share1.7affected
stonith404pingvin-share1.8affected
stonith404pingvin-share1.9affected
stonith404pingvin-share1.10affected
stonith404pingvin-share1.11affected
stonith404pingvin-share1.12affected
stonith404pingvin-share1.13.0affected

Weaknesses

  • CWE-79: Cross Site Scripting
  • CWE-94: Code Injection

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References