CVE-2026-56747
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value.
Risk Assessment
An attacker could execute arbitrary JavaScript code on the server, potentially leading to data theft, configuration modification, or server takeover.
Recommendation
Update Cribl Stream to version 4.18.2 or later.
Other vulnerabilities in Cribl Stream
Original NVD description (English source)
Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value.