XSS in wrensec-commons CREST framework HTTP binding via _mimeType parameter
Affects wrensec-commons below 22.6.2 and 23.0.0-M1 through 23.0.0 when the CREST HTTP binding handles the _mimeType parameter set to text/html. Fixed in 22.6.2 and 23.0.0.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 22.6.2, 23.0.0
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affected versions are from 23.0.0-M1 up to 23.0.0, and below 22.6.2. The _mimeType request parameter is used on the CREST HTTP binding, set to text/html.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 18/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 22.6.2, 23.0.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
The wrensec-commons CREST framework, used for HTTP-based REST APIs, is affected when it reflects a request parameter into the response's content type. An attacker can trick a user into opening a crafted link, causing the browser to run malicious JavaScript in the context of the affected site.
Read the original description
wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0.
What to do
Check whether your setup matches what the bug needs.
Affected versions are from 23.0.0-M1 up to 23.0.0, and below 22.6.2. The _mimeType request parameter is used on the CREST HTTP binding, set to text/html.Upgrade to a fixed version: 22.6.2, 23.0.0.
Workaround: Disallow the _mimeType request parameter (in both query and x-www-form-urlencoded body).
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- org.wrensecurity.commons:json-resource-http
fixed in 22.6.2; From 23.0.0-M1 · fixed in 23.0.0
Evidence 3
- Advisory
- Patch
- Patch
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-2102
What does this mean?
The CREST HTTP binding accepts a _mimeType request parameter, and when it is set to text/html an attacker can get a victim's browser to run malicious front-end code (cross-site scripting). Victims can be redirected to a CREST endpoint that runs the code.Source: github.com
Am I affected, and how do I check?
Versions below 22.6.2, and 23.0.0-M1 up to 23.0.0, are affected. To check a deployment, look at its wrensec-commons version and whether the CREST HTTP binding accepts the _mimeType parameter.Source: github.com
What should I do about it?
Upgrade to 22.6.2 or 23.0.0, matching the release line in use. Until the upgrade is done, disallow the _mimeType request parameter in both query strings and x-www-form-urlencoded bodies.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data