Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
HIGH severity

CVE-2026-54064 — nukeviet/nukeviet

HIGH

CVE-2026-54064 is a high-severity (CVSS 8.7) vulnerability in nukeviet/nukeviet. A fix is available for nukeviet/nukeviet — see the affected versions and patch details below.

NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module

Published
Jul 13, 2026
Updated
Jul 13, 2026
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Jul 13, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐘nukeviet/nukeviet

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Two filter-bypass techniques in NukeViet\Core\Request::filterAttr() and NukeViet\Core\Request::unhtmlentities() allow a low-privileged user (any account with news post permission) to store and serve arbitrary JavaScript to any visitor of the affected page.

Affected Component

vendor/vinades/nukeviet/Core/Request.php — class NukeViet\Core\Request

Vulnerability Details

Bypass 1 — Form Feed character prefix (\x0C) before event handler name

The filterAttr() method blocks event-handler attributes using:

preg_match('/^on/i', $attrSubSet[0])

PHP's trim() does not strip the ASCII Form Feed character (\x0C, U+000C). An attacker can prefix the attribute name with \x0C so that \x0Conerror does not match /^on/. The HTML5 browser parser treats \x0C as a valid whitespace separator and correctly activates the event handler.

Proof-of-concept payload (URL-encoded POST body field bodyhtml):

<img src="x" %0Conerror="alert('XSS')">

Bypass 2 — Decimal HTML entity tab (&#9;) inside javascript: URI

unhtmlentities() strips the hex-encoded tab &#x09; via str_ireplace, but did not strip its decimal equivalent &#9;. The keyword-blocking regex /j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t/si uses \s* which does not match HTML entities. The value jav&#9;ascript:alert() passes the filter, is stored in the database, and is decoded by the browser into a working javascript: URI.

Proof-of-concept payload (inside a Markdown-style link):

[Click me](jav&#9;ascript:alert('XSS'))

Impact

An authenticated attacker with news-posting permission can inject persistent JavaScript that executes in the browser of any user (including administrators) who views the affected article. This enables session cookie theft, credential harvesting, defacement, and further privilege escalation.

Patches

Fixed in commit <commit-sha> by modifying vendor/vinades/nukeviet/Core/Request.php:

  1. filterAttr() — strip all ASCII control characters (\x00–\x20) from the attribute name before the /^on/ check:

    $attrSubSet[0] = preg_replace('/[\x00-\x20]/', '', strtolower($attrSubSet[0]));

  2. unhtmlentities() — strip decimal HTML entities for all ASCII control characters (0–31) before the keyword checks:

    $value = preg_replace('/&#0*(?:3[01]|[12][0-9]|[0-9]);/', '', $value);

Workarounds

None. Update to the patched version.

Resources

  • CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
  • OWASP WSTG-INPV-02: Testing for Stored Cross Site Scripting
  • OWASP Top 10 A03:2021 – Injection

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistnukeviet/nukevietall versions4.6.00composer require nukeviet/nukeviet:^4.6.00

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for nukeviet/nukeviet, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update nukeviet/nukeviet to 4.6.00 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-54064 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2026-54064 can be triaged on real exposure rather than presence alone.

Tailored to CVE-2026-54064. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary Two filter-bypass techniques in `NukeViet\Core\Request::filterAttr()` and `NukeViet\Core\Request::unhtmlentities()` allow a low-privileged user (any account with news post permission) to store and serve arbitrary JavaScript to any visitor of the affected page. ## Affected Component `vendor/vinades/nukeviet/Core/Request.php` — class `NukeViet\Core\Request` ## Vulnerability Details ### Bypass 1 — Form Feed character prefix (`\x0C`) before event handler name The `filterAttr()` method blocks event-handler attributes using: ```php preg_match('/^on/i', $attrSubSet[0]) ``` PHP's `tri
O3 Security · Impact-Aware SCA

Is CVE-2026-54064 in your dependencies?

O3 Security finds CVE-2026-54064 across Packagist dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works