Part-DB: Stored HTML injection in BOM validation results via unescaped Part name

Description

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a Part name can store HTML markup in the Part name. When another user imports a BOM CSV referencing that Part ID, the malicious Part name is rendered as HTML in the victim's BOM validation result page. This results in a cross-user stored HTML injection issue. JavaScript execution appears to be blocked by the current Content Security Policy, but arbitrary HTML links, forms, images, and CSS-based UI elements can still be injected into a trusted Part-DB page. This issue has been patched in version 2.12.2.

Scores

EPSS (exploitation in 30 days)

0.44% · top 61% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.7.

Weakness

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

• Part-DB · Part-DB-server

  • affected < 2.12.2

References (2)

• https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-qqrh-jjhg-vv5r (opens in a new tab)x_refsource_CONFIRMexploit
• https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.2 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-55600](https://trackcve.app/badge/CVE-2026-55600.svg)](https://trackcve.app/cve/CVE-2026-55600)

Record last updated 30 Oct 2026, 16:30 UTC.