CVE-2026-110239: rapyd-admin 0.4.0, 0.8.5 through 0.12.17, 1.0.0, 1.1.0 through 1.1.8, 9.0.0 to before 9.20.0

Affected technology

rapyd-admin · 0.4.0, 0.8.5 through 0.12.17, 1.0.0, 1.1.0 through 1.1.8, 9.0.0 to before 9.20.0
zofe

Description’s affected range: before 9.20.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction

What an attacker can do

Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form. Vendor/CNA’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality, integrity and availability impact as none.