Part-DB: Stored HTML injection in BOM validation results via unescaped Part name
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.12.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Part-DB, an open source electronics inventory management system, is affected by a stored HTML injection flaw in its BOM import validation pages. A user who can edit a part name can insert HTML that is displayed unescaped to other users who import a BOM referencing that part, allowing malicious links, forms, or visual elements to appear within a trusted Part-DB page.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a Part name can store HTML markup in the Part name. When another user imports a BOM CSV referencing that Part ID, the malicious Part name is rendered as HTML in the victim's BOM validation result page. This results in a cross-user stored HTML injection issue. JavaScript execution appears to be blocked by the current Content Security Policy, but arbitrary HTML links, forms, images, and CSS-based UI elements can still be injected into a trusted Part-DB page. This issue has been patched in version 2.12.2.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Part-DB Part-DB-server
fixed in 2.12.2