CVE-2026-42192

{
  "id": "CVE-2026-42192",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-08T22:16:31.133",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cross-site scripting (XSS) vulnerability exists in the campaign management feature, where the email body content created by authenticated project members is stored and later rendered in the admin dashboard using React's dangerouslySetInnerHTML without any HTML sanitization. This allows a lower-privileged member to embed malicious scripts in a campaign's email body that execute in the context of any admin or other member who views the campaign, potentially enabling session hijacking or unauthorized actions on their behalf. This issue has been patched in version 0.9.0."
    },
    {
      "lang": "es",
      "value": "Plunk es una plataforma de correo electrónico de código abierto construida sobre AWS SES. Antes de la versión 0.9.0, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en la función de gestión de campañas, donde el contenido del cuerpo del correo electrónico creado por miembros autenticados del proyecto se almacena y luego se renderiza en el panel de administración usando dangerouslySetInnerHTML de React sin ninguna sanitización HTML. Esto permite a un miembro con privilegios inferiores incrustar scripts maliciosos en el cuerpo del correo electrónico de una campaña que se ejecutan en el contexto de cualquier administrador u otro miembro que vea la campaña, lo que podría permitir el secuestro de sesión o acciones no autorizadas en su nombre. Este problema ha sido parcheado en la versión 0.9.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "useplunk",
          "product": "plunk",
          "versions": [
            {
              "version": "< 0.9.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T02:06:32.646585Z",
          "id": "CVE-2026-42192",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/useplunk/plunk/releases/tag/v0.9.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/useplunk/plunk/security/advisories/GHSA-mjqc-qrv3-24hq",
      "source": "[email protected]"
    }
  ]
}