CVE-2026-126814
blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary t
CVSS
3.5
Low
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 11, 2026 · Last modified: Nov 11, 2026 · CWE-829
Not enough EPSS history yet.
blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in BlueprintService::findVideoProvider(). Attackers can set a blueprint video URL on an attacker-controlled host, which site.js loads in an unsandboxed iframe after consent, framing fake login forms or malware downloads.
- github.comhttps://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.5/app/services/www/BlueprintService.php#L700-L716
- github.comhttps://github.com/blueprintue/blueprintue-self-hosted-edition/commit/5f13e2bb8cd4c620899e9f8afd41a6e62b3bc6a4
- github.comhttps://github.com/blueprintue/blueprintue-self-hosted-edition/pull/269
- github.comhttps://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.6
- github.comhttps://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-3vgc-fcfg-v233
- www.vulncheck.comhttps://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.6-arbitrary-iframe-embedding-via-peertube-matcher
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-961297.8 HIG24.2%
——7Inclusion of functionality from untrusted control sphere in Windows Kernel allows an authorized attacker to elevate privileges locally.1dCVE-2026-960387.8 HIG24.2%
——7Inclusion of functionality from untrusted control sphere in Windows Audio Service allows an authorized attacker to elevate privileges locally.1dCVE-2026-959327.8 HIG24.2%
——7Inclusion of functionality from untrusted control sphere in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.1dCVE-2026-1182258.8 HIG33.3%
——10Inclusion of functionality from untrusted control sphere in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.1dCVE-2026-1137677.8 HIG33.3%
——10Inclusion of functionality from untrusted control sphere in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.1dCVE-2026-115791—5.4%
——2When tarfile or zipfile command line interface (CLI) is used to
decompress an archive, a Python script shadowing the stdlib can be
created. Then if an error occurs during decompressing the next file,
the newly created Python script is executed. This is especially true
if the created Python is called traceback.py. The problem is that
Python adds the current directory to sys.path when python -m MODULE is
run, and the archive is also decompressed in the current directory.
The fix removes sys.path[0] in gzip, tarfile and zipfile command line
interface to prevent shadowing standard library modules from extracted
files.21h