CVE-2026-55891

🗓️ 28 Aug 2026 20:23:50Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 33 Views🌐 WEB

Reflected JSON injection in PrivateBin before 2.0.5 via unescaped REQUEST_URI in JSON-LD responses.

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2026-55891 PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI	28 Aug 202620:23	–	cvelist
EUVD	EUVD-2026-67940	28 Aug 202620:23	–	euvd
Github Security Blog	PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI	28 Aug 202620:25	–	github
NVD	CVE-2026-55891	28 Aug 202622:16	–	nvd
OSV	GHSA-XRJC-C68J-HP7W PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI	28 Aug 202620:25	–	osv
Positive Technologies	PT-2026-83351	28 Aug 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-55891 PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI	28 Aug 202620:23	–	vulnrichment

Vulners

Node

privatebin privatebinRange<2.0.5

[
  {
    "vendor": "PrivateBin",
    "product": "PrivateBin",
    "versions": [
      {
        "version": "< 2.0.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/PrivateBin/PrivateBin/security/advisories/GHSA-xrjc-c68j-hp7w
github	www.github.com/PrivateBin/PrivateBin/releases/tag/2.0.5
github	www.github.com/PrivateBin/PrivateBin/commit/164c839c39688533ef0086575878e8392cd21249

Parameter	Position	Path	Description	CWE
jsonld	query param	/?jsonld=	JSON-LD injection via attacker-controlled value inserted into templates used by jsonld responses.	CWE-116
pasteid	query param	/?pasteid	JSON-LD injection via attacker-controlled paste identifier used in templates.	CWE-116

09 Sep 2026 21:09Current

6Medium risk

Vulners AI Score6

EPSS0.00328

SSVC

CWE-116