CVE-2026-112038 diem-project CVE debrief

Who should care

Defenders responsible for diem-project diem deployments should assess exposure and prioritize verification due to the rolling release approach and potential for remote exploitation.

Why it matters

CVE-2026-112038 is a cross-site scripting vulnerability in diem-project diem's Version Check Service. Defenders should verify inventory, assess exposure, and monitor for exploitation attempts due to the rolling release approach and potential for remote exploitation.

• Verify inventory for potential vulnerability
• Assess exposure due to rolling release approach
• Monitor for exploitation attempts
• Consider compensating controls until fix available

Technical summary

The vulnerability affects the Version Check Service's dmAdminCtrl.js file in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. The manipulation leads to cross-site scripting, allowing for remote exploitation. Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing exposure, given the rolling release approach makes version-based identification challenging. The project follows a rolling release approach, so version details for affected or updated releases are not provided.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing exposure, given the rolling release approach makes version-based identification challenging.

Recommended defensive actions

• Verify the presence of this vulnerability in your inventory
• Assess exposure given the rolling release approach
• Monitor for potential exploitation attempts
• Consider compensating controls until an official fix is available
• Review vendor guidance for patching or mitigating the vulnerability
• Perform an exposure review to identify potentially affected systems
• Track the status of remediation efforts through source tracking

Evidence notes

The CVE record and source item provide details on the vulnerability. However, the project's rolling release approach and lack of detailed version information limit the assessment of affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.