CVE-2026-8152

CriticalCVSS 9.3/10Last modified Oct 24, 2026

Description

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.

When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.

Metrics

CVSS 4.0 9.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Jul 22, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-815207.5A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beCVE-2026-815216.5The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator charactCVE-2026-815228.1A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifCVE-2026-815234.4A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier CVE-2026-815245.4A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitiCVE-2026-815258.1The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before usinCVE-2026-815266.5The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it CVE-2026-815276.5A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregatioCVE-2026-815285.4A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a valueCVE-2026-815297.1Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an apCVE-2026-81539.8OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthenticated attacker toCVE-2026-815305.6A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material