CVE-2026-108802: medium-severity vulnerability in y_project RuoYi
y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting
Published · Updated
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.1epss 0.2%
exploitation probability
0.2%top 90% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
y_project · RuoYipublic PoCs found — 1
cve_referencegithub.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xss/tree/main/pocunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — y_project RuoYi
In the same product, most dangerous first.
CVE-2023-3163LOWy_project RuoYi filterKeyword resource consumptionEPSS 1.4%CVE-2022-4566MEDIUMy_project RuoYi GenController sql injectionEPSS 0.9%CVE-2023-7133MEDIUMy_project RuoYi HTTP POST Request login cross site scriptingEPSS 0.7%CVE-2023-3815LOWy_project RuoYi File Upload uploadFilesPath cross site scriptingEPSS 0.6%CVE-2025-0734MEDIUMy_project RuoYi Whitelist getBeanName deserializationEPSS 0.5%CVE-2025-4819LOWy_project RuoYi Offline Logout batchForceLogout improper authorizationEPSS 0.5%
References
https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xsshttps://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xss/tree/main/pochttps://vuldb.com/cve/CVE-2026-108802https://vuldb.com/submit/962540https://vuldb.com/vuln/416579https://vuldb.com/vuln/416579/cti