CVE-2026-105289 feelec-yishu CVE debrief

Who should care

Defenders responsible for the feelec-yishu feelcrm-os 1.0.0 system should assess their exposure and prioritize verification and potential remediation. This includes reviewing the system for potential vulnerabilities, assessing the impact of cross-site scripting attacks, and implementing compensating controls to mitigate the vulnerability. Defenders should also verify the presence of this vulnerability in their inventory and assess the potential impact of

Why it matters

Defenders should care about CVE-2026-105289 because it is a cross-site scripting vulnerability in feelec-yishu feelcrm-os 1.0.0 that could be exploited remotely. The exploit has been made public, and defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the potential impact of cross-site scripting attacks.

• Potential for cross-site scripting attacks
• Need to verify presence of vulnerability in inventory
• Possible impact on customer data or system integrity
• Requires assessment of compensating controls

Technical summary

The vulnerability is located in the htmlspecialchars_decode function of the CrmDefineFormModel.class.php file in the Create Customer Endpoint. An attacker can manipulate the customer_form[remark] argument to inject malicious code. This vulnerability affects feelec-yishu feelcrm-os 1.0.0 and could be exploited remotely. The exploit has been made public, and defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the potential impact of cross-site scripting attacks. The vulnerability allows for cross-site scripting attacks, which could potentially impact customer data or system integrity.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the potential impact of cross-site scripting attacks.

Recommended defensive actions

• Verify the presence of this vulnerability in your inventory
• Assess the potential impact of cross-site scripting attacks
• Consider implementing compensating controls to mitigate the vulnerability
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The exploit has been made public, but there is no information on actual attacks or victims. Defenders should verify the presence of this vulnerability in their inventory and assess the potential impact of cross-site scripting attacks. The vulnerability is located in the htmlspecialchars_decode function of the CrmDefineFormModel.class.php file in the Create Customer Endpoint. An attacker can manipulate the customer_form[remark] argument to inject (at) (

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.