OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-92784

HIGH · CVSS 7.5 EPSS 0.48% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-16 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

The vulnerability affects the @refinedev/inferencer library in Java, specifically versions up to 7.0.0, which fails to properly escape API field names during JSX source code generation. This flaw allows attackers to inject malicious JavaScript via crafted JSON property names, leading to potential code execution in the developer's browser when the Inferencer page is rendered. Developers using this library should prioritize patching to mitigate the risk of client-side attacks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-92784
Severity
HIGH
CVSS
7.5
EPSS
0.48%
Java

Original NVD Description

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders.