{"id":"CVE-2026-101157","published":"2026-10-06T20:17:09.983","lastModified":"2026-10-07T13:38:48.657","description":"A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated browser session, access sensitive data, modify system state, or disrupt affected services.","cvssScore":8.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24808-security-advisory-0192","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows an attacker to inject malicious content that can be executed in the context of an authenticated user, potentially compromising their session and accessing sensitive data.","exploitability":"Exploitation requires adjacent-network access and an unauthenticated attacker, making it moderately difficult to achieve.","blast_radius":"If exploited, the attacker could access sensitive data, modify system state, or disrupt services, impacting the victim's authenticated browser session.","remediation":"Disable the affected feature or restrict access to the named endpoint.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","web","auth-compromise","session-hijacking"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:44:40.359Z"}}