CVE-2026-56747
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value.
Risk Assessment
An attacker could execute arbitrary JavaScript code on the server, potentially leading to data theft, configuration modification, or server takeover.
Recommendation
Update Cribl Stream to version 4.18.2 or later.
Other vulnerabilities in Cribl Stream
Original NVD description (English source)
Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS