Verified

CVE-2026-104587: n/a n/a

Affected technology

n/a · n/a
Vendor not specified by the source

Description’s affected range: through commit 6e2bf34

Component: Not specified by the source

What an attacker can do

An attacker can craft a malicious bookmark URL containing HTML attribute-breaking payloads that execute arbitrary JavaScript in the victim's browser context when rendered in the local web interface.

Published 14-Oct-2026 05:22 UTC

KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-14 06:30:49.831175+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-14 05:19:44.455882+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-104587.html