Platform
java
Component
forest
Fixed in
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
CVE-2026-2947 describes a cross-site scripting (XSS) vulnerability discovered in rymcu forest versions 0.0.1 to 0.0.5. This flaw resides within the updateUserInfo function of the User Profile Handler component. Successful exploitation allows remote attackers to inject malicious scripts, potentially leading to session hijacking or defacement. A public proof-of-concept is available, indicating an elevated risk of exploitation.
The primary impact of CVE-2026-2947 is the ability for an attacker to inject arbitrary JavaScript code into the rymcu forest application. This can be leveraged to steal user session cookies, redirect users to malicious websites, or modify the content displayed to users. Given the remote nature of the exploit and the availability of a public proof-of-concept, the blast radius is significant, potentially affecting all users of vulnerable installations. The vulnerability's location within the User Profile Handler suggests that user-supplied data is not properly sanitized before being rendered, a common root cause for XSS vulnerabilities. Attackers could craft malicious URLs or inject scripts through user input fields to trigger the vulnerability.
CVE-2026-2947 is a relatively low-severity vulnerability (CVSS 3.5) due to the potential for limited impact. However, the availability of a public proof-of-concept significantly increases the likelihood of exploitation. The vulnerability was disclosed on 2026-02-22, and the vendor was contacted but did not respond. There is no indication of active exploitation campaigns at this time, but the public PoC makes it a prime target for opportunistic attackers.
Exploit Status
EPSS
0.03% (9% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-2947 is to upgrade to a patched version of rymcu forest. Unfortunately, the input does not specify a fixed version. Until a patch is available, consider implementing input validation and output encoding on the updateUserInfo function to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Review and strengthen the application's security policies to prevent similar vulnerabilities from being introduced in the future. After upgrade, confirm by attempting to trigger the updateUserInfo function with a known malicious payload and verifying that the script is not executed.
Update to a version later than 0.0.5, where the Cross-Site Scripting (XSS) vulnerability in the User Profile Handler component has been fixed. Since the vendor has not responded, it is recommended to look for community forks or alternative solutions, or consider migrating to a different solution.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-2947 is a cross-site scripting (XSS) vulnerability affecting rymcu forest versions 0.0.1 through 0.0.5, allowing remote attackers to inject malicious scripts.
You are affected if you are using rymcu forest versions 0.0.1 to 0.0.5. Upgrade to a patched version as soon as one is available.
Upgrade to a patched version of rymcu forest. Until a patch is available, implement input validation and output encoding on the updateUserInfo function.
While there's no confirmed active exploitation, a public proof-of-concept exists, increasing the risk of exploitation.
The vendor was contacted but did not respond. Check the rymcu forest project's website or GitHub repository for updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your pom.xml file and we'll tell you instantly if you're affected.