CVE-2026-92784
Last modified
CVE-2026-92784 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. @refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders.. EPSS estimates a 0.48% chance of exploitation in the next 30 days.
Description
@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| refinedev | @refinedev/inferencer | <= 7.0.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-92784?
How severe is CVE-2026-92784?
How do I fix CVE-2026-92784?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92779Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 con…7.6
- CVE-2026-9278The Form Builder CP WordPress plugin before 1.2.47 does not …5.4
- CVE-2026-92780KnowStreaming through 3.4.1 fails to enforce role-based acce…8.8
- CVE-2026-92781Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 con…6.3
- CVE-2026-92782Chroma through 1.5.9 fails to validate tenant and database s…8.1
- CVE-2026-92783Yeti through 2.11.0 fails to validate caller permissions in …8.1
- CVE-2026-92785Angel through 3.3.0 deserializes untrusted setAlgoMetrics pa…8.1
- CVE-2026-92786LightGBM through 4.7.0 fails to validate child and split arr…7.8
- CVE-2026-92787Feast through 0.66.0 fails to verify JWT token signatures be…9.8
- CVE-2026-92788Coze Studio through 0.5.1 fails to validate that table names…8.8
- CVE-2026-92789Graylog through 7.1.4 validates outbound URLs against an all…6.5
- CVE-2026-9279Logseq exposes an IPC handler that allows the renderer proce…8.7
Are you affected by CVE-2026-92784?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST