CVE-2026-8152
Gravedad CVSS v4.0:
CRÍTICA
Tipo:
CWE-79
Neutralización incorrecta de la entrada durante la generación de la página web (Cross-site Scripting)
Fecha de publicación:
22/07/2026
Última modificación:
22/07/2026
Descripción
*** Pendiente de traducción *** Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.<br />
<br />
<br />
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application&#39;s cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu&#39;s. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.
Impacto
Puntuación base 4.0
9.30
Gravedad 4.0
CRÍTICA