CVE-2026-109131— Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)
Quick assessment
Affected
Red Hat Red Hat Ansible Automation Platform 2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
统一 Ansible Automation Platform UI（基于上游 ansible-ui 构建，前端位于 hub 模块）中的 Hub collection 模块文档渲染器，会将文档中的 URL 部分（通过 DocumentationParsers.tsx 中的 formatPartURL 函数处理）直接渲染为链接，且未对 URL 协议/方案进行限制。因此，如果某个 collection 的文档中包含使用可执行脚本的 URL 协议的链接，当其他已认证用户在 collection 文档页面中查看并激活该链接时
Possible ATT&CK Techniques 2 AI
T1189 · Drive-by Compromise T1059 · Command and Scripting InterpreterAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | any |
affected |
any |
affected | ||
any |
affected | ||
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109131
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)
Source: CVE Program / CVE List V5
Vulnerability Description
The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub) renders a documentation URL part (formatPartURL in DocumentationParsers.tsx) as a link without restricting the URL protocol/scheme. A collection whose documentation contains a link using a script-executing URL scheme can therefore cause script to run in the same origin as the Hub UI when another authenticated user views and activates that link in the collection documentation page. This is a stored cross-site scripting issue in shipped Platform UI code (present in the AAP 2.6 and 2.7 release branches).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
II. Public POCs for CVE-2026-109131
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109131
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109131 (2)
Same Patch Batch · Red Hat · 2026-10-15 · 10 CVEs total
| CVE-2026-85634 | 8.8 HIGH | Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in |
| CVE-2026-92982 | 8.5 HIGH | Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 te |
| CVE-2026-108334 | 7.4 HIGH | Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-ope |
| CVE-2026-84823 | 7.1 HIGH | Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configurat |
| CVE-2026-110923 | 6.5 MEDIUM | Openssh: openssh: sftp can write outside the destination directory from a server-supplied |
| CVE-2026-110925 | 5.4 MEDIUM | Openssh: openssh: '$' and '\' in a command-line username expand through %u |
| CVE-2026-110926 | 5.3 MEDIUM | Openssh: openssh: shared lz77 compression dictionary leaks plaintext across channels |
| CVE-2026-110924 | 4.8 MEDIUM | Openssh: openssh: gssapi delegated credentials can be stored after a failed authentication |
| CVE-2026-110927 | 4.3 MEDIUM | Openssh: openssh: a compressed payload can expand past the maximum packet size |
IV. Related Vulnerabilities
Same product: Red Hat Ansible Automation Platform 2
-
CVE-2026-103869
Pulp-ansible: bearer tokens are reused across remotes in a w -
CVE-2026-103868
Pulp-container: registry credentials are reused across remot -
CVE-2026-106033
Ansible: ansible-ui: ansible ui dom xss in /redirect next pa -
CVE-2026-103754
Ansible-runner: ansible-runner: path traversal and symlink e -
CVE-2026-90959
Pulpcore: pulpcore: file:// scheme allowlist bypass in conte
Same vendor: Red Hat
-
CVE-2026-84823
Org.wildfly.core: wildfly: path traversal in take-snapshot d -
CVE-2026-108334
Github.com/kuadrant/kuadrant-operator/internal/wasm: github. -
CVE-2026-85634
Wildfly-core: wildfly-core: deployer rbac role privilege esc -
CVE-2026-92982
Ansible-operator-plugins: ansible operator plugins: arbitrar -
CVE-2026-110927
Openssh: openssh: a compressed payload can expand past the m
Same weakness: CWE-79
-
CVE-2026-103481
Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting v -
CVE-2026-109998
Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scri -
CVE-2026-109512
Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cro -
CVE-2026-107758
Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cro -
CVE-2026-109207
RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored
V. Comments for CVE-2026-109131
No comments yet