CVE-2026-112042 diem-project CVE debrief

Who should care

Defenders responsible for systems using diem-project diem should assess exposure and prioritize verification of this vulnerability. They should also review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, defenders should consider the potential impact of cross-site scripting attacks on their systems and implement necessary mitigations.

Why it matters

Defenders should prioritize verifying the presence of this cross-site scripting vulnerability in diem-project diem and assess the potential impact of such attacks. The corpus does not establish versions, exploitation, impact, or remediation.

• Cross-site scripting attacks may be possible
• Verify the presence of this vulnerability in your systems
• Assess the potential impact of cross-site scripting attacks

Technical summary

The vulnerability affects the function dmBaseLinkTag::text of the file dmCorePlugin/lib/view/html/link/dmBaseLinkTag.php of the component dmWidget in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad, allowing for cross-site scripting attacks due to improper handling of the argument text. Defenders should prioritize verifying the presence of this vulnerability in their systems and assess the potential impact of cross-site scripting attacks. The project was informed of the problem early through an issue report but has not responded yet.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems and assess the potential impact of cross-site scripting attacks.

Recommended defensive actions

• Verify the presence of this vulnerability in your systems
• Assess the potential impact of cross-site scripting attacks
• Implement compensating controls to prevent exploitation
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and source metadata indicate a cross-site scripting vulnerability in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. However, the corpus does not establish versions, exploitation, impact, or remediation. Defenders should verify the presence of this vulnerability in their systems and assess potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.