{"id":"CVE-2026-24824","summary":"A XSS in yacy/yacy_search_server","details":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in yacy yacy_search_server (source/net/yacy/http/servlets modules). This vulnerability is associated with program files YaCyDefaultServlet.Java.\n\nThis issue affects yacy_search_server.","modified":"2026-08-12T03:51:14.496624570Z","published":"2026-01-27T09:01:06.551Z","database_specific":{"cna_assigner":"GovTech CSG","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24824.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24824.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24824"},{"type":"FIX","url":"https://github.com/yacy/yacy_search_server/pull/722"},{"type":"PACKAGE","url":"https://github.com/yacy/yacy_search_server"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yacy/yacy_search_server","events":[{"introduced":"0"},{"last_affected":"fce701f5cc87809a44e3fd7a036c7b1445334a3a"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"last_affected":"1.92"}]}}],"versions":["Release_1.92","Release_1.90","Release_1.82","Release_1.80","Release_1.72","Release_1.7","Release_1.68","0.99"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24824.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/AU:Y/R:U/V:D/RE:M/U:Amber"}]}