PT-2026-94061

Name of the Vulnerable Software and Affected Versions @refinedev/inferencer versions prior to 7.0.1 Description The software fails to escape API field names during their interpolation into generated JSX source code. This allows attackers who control the data provider to inject malicious JavaScrip...

CVE-2026-92784: Improper Control of Generation of Code

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...