CVE-2026-27639
Mercator vulnerable to stored XSS via unescaped Blade directives in display templates
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Mercator is an open source web application designed to enable mapping of information systems. A stored Cross-Site Scripting (XSS) vulnerability exists in Mercator prior to version 2026.02.22 due to the use of unescaped Blade directives (`{!! !!}`) in display templates. An authenticated user with the User role can inject arbitrary JavaScript payloads into fields such as "contact point" when creating or editing entities. The payload is then executed in the browser of any user who views the affected page, including administrators. Version 2026.02.22 fixes the vulnerability.
| CWE | CWE-79 |
| Vendor | dbarzin |
| Product | mercator |
| Published | Feb 25, 2026 |
| Last Updated | Feb 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for dbarzin mercator
Be the first to know when new unknown vulnerabilities affecting dbarzin mercator are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
dbarzin / mercator
< 2026.02.22
References
github.com: https://github.com/dbarzin/mercator/security/advisories/GHSA-65p7-pph2-966g github.com: https://github.com/dbarzin/mercator/commit/839d231399944e43a865198262e96e0218252cc3 github.com: https://github.com/dbarzin/mercator/commit/9902ffd91f287e474729f514c77261f4ef7db8fe github.com: https://github.com/dbarzin/mercator/commit/c58bb1d2fff18605c61d93cfaf77adca416c560a