{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27020", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-17T03:08:23.490Z", "datePublished": "2026-02-20T21:03:42.431Z", "dateUpdated": "2026-02-24T18:31:33.136Z"}, "containers": {"cna": {"title": "Photobooth has a XSS vulnerability in user input", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/lukas12000/photobooth/security/advisories/GHSA-x2m3-43gg-rrgq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lukas12000/photobooth/security/advisories/GHSA-x2m3-43gg-rrgq"}], "affected": [{"vendor": "lukas12000", "product": "photobooth", "versions": [{"version": "< 1.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T21:03:42.431Z"}, "descriptions": [{"lang": "en", "value": "Photobooth prior to 1.0.1 has a cross-site scripting (XSS) vulnerability in user input fields. Malicious users could inject scripts through unvalidated form inputs. This vulnerability is fixed in 1.0.1."}], "source": {"advisory": "GHSA-x2m3-43gg-rrgq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T18:31:12.351333Z", "id": "CVE-2026-27020", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:31:33.136Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27020", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T18:31:12.351333Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:31:21.276Z"}}], "cna": {"title": "Photobooth has a XSS vulnerability in user input", "source": {"advisory": "GHSA-x2m3-43gg-rrgq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "lukas12000", "product": "photobooth", "versions": [{"status": "affected", "version": "< 1.0.1"}]}], "references": [{"url": "https://github.com/lukas12000/photobooth/security/advisories/GHSA-x2m3-43gg-rrgq", "name": "https://github.com/lukas12000/photobooth/security/advisories/GHSA-x2m3-43gg-rrgq", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Photobooth prior to 1.0.1 has a cross-site scripting (XSS) vulnerability in user input fields. Malicious users could inject scripts through unvalidated form inputs. This vulnerability is fixed in 1.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T21:03:42.431Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27020", "state": "PUBLISHED", "dateUpdated": "2026-02-24T18:31:33.136Z", "dateReserved": "2026-02-17T03:08:23.490Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-20T21:03:42.431Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "photobooth", "vendor": "lukas12000", "versions": [{"status": "affected", "version": "< 1.0.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Photobooth prior to 1.0.1 has a cross-site scripting (XSS) vulnerability in user input fields. Malicious users could inject scripts through unvalidated form inputs. This vulnerability is fixed in 1.0.1."}, {"lang": "es", "value": "Photobooth anterior a la versi\u00f3n 1.0.1 tiene una vulnerabilidad de cross-site scripting (XSS) en los campos de entrada de usuario. Usuarios malintencionados podr\u00edan inyectar scripts a trav\u00e9s de entradas de formulario no validadas. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.0.1."}], "id": "CVE-2026-27020", "lastModified": "2026-06-17T10:26:32.890", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27020", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T18:31:12.351333Z", "version": "2.0.3"}}]}, "published": "2026-02-20T21:19:27.940", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/lukas12000/photobooth/security/advisories/GHSA-x2m3-43gg-rrgq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "photobooth", "source": "cna", "vendor": "lukas12000"}, "product": "photobooth", "vendor": "lukas12000"}], "analysis": {"en": {"generated_at": "2026-04-18T11:27:08.351809+00:00", "value": {"mitigation_remediation": ["Upgrade Photobooth to version 1.0.1 or later to fix the XSS vulnerability", "Enable a strong Content Security Policy (CSP) header to limit the execution of injected scripts", "Implement server\u2011side input sanitization to encode or escape potentially dangerous characters in all user\u2011supplied fields"], "summary": {"action": "Patch", "impact": "Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "The flaw affects the Photobooth application developed by lukas12000, specifically all releases before version 1.0.1. Users deploying earlier versions are exposed to the described XSS risk.", "description_and_impact": "Photobooth versions prior to 1.0.1 contain a cross\u2011site scripting flaw that allows an attacker to inject malicious JavaScript into unvalidated form input fields. The vulnerability enables the execution of arbitrary scripts in the context of the victim\u2019s browser, potentially leading to session hijacking, defacement or phishing attacks. This weakness is identified as CWE\u201179, a classic cross\u2011site scripting issue.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild as of the latest data, and the vulnerability is not listed in the CISA Known Exploit Vulnerabilities catalog. The likely attack vector involves a malicious user submitting crafted input through the public user-facing form fields within Photobooth. An attacker can trigger the vulnerability without requiring additional privileges or exploits against the host system."}}}}, "created": "2026-02-23T14:35:08.469138+00:00", "updated": "2026-04-18T11:30:44.324339+00:00", "vendors": ["lukas12000", "lukas12000$PRODUCT$photobooth"]}