CVE-2026-55600 Part-DB CVE debrief

Who should care

Defenders responsible for inventory management systems, particularly those using Part-DB, should assess exposure and prioritize remediation. System administrators and security teams should review the affected versions and patched version to ensure timely upgrades and adjustments to security policies.

Why it matters

CVE-2026-55600 is a stored HTML injection vulnerability in Part-DB that allows an attacker to inject HTML markup into Part names, which are then rendered in BOM validation result pages. Defenders should prioritize upgrading to version 2.12.2 or later and review Content Security Policy settings to mitigate potential impacts.

• Potential injection of arbitrary HTML elements into trusted Part-DB pages
• Possible disruption of user experience through injected content
• Risk of phishing or other social engineering attacks via injected links or forms
• Need for verification of Part-DB version and Content Security Policy effectiveness

Technical summary

The vulnerability in Part-DB, an open-source inventory management system, allows an attacker to store HTML markup in a Part name. When another user imports a BOM CSV referencing that Part ID, the malicious Part name is rendered as HTML in the victim's BOM validation result page, leading to a cross-user stored HTML injection issue. This issue is patched in version 2.12.2. The vulnerability arises from the rendering of BOM validation information messages using Twig's |raw filter, which includes translated placeholders populated with user-controlled Part names. Defenders should prioritize upgrading to Part-DB version 2.12.2 or later to address the stored HTML injection vulnerability.

Defensive priority

Defenders should prioritize upgrading to Part-DB version 2.12.2 or later to address the stored HTML injection vulnerability. Additionally, reviewing and adjusting the Content Security Policy (CSP) to prevent the injection of arbitrary HTML elements is recommended.

Recommended defensive actions

• Upgrade to Part-DB version 2.12.2 or later
• Review and adjust Content Security Policy (CSP) settings
• Monitor for suspicious activity related to BOM validation results
• Verify Part-DB version and Content Security Policy effectiveness
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and patched version. The GitHub advisory (GHSA-qqrh-jjhg-vv5r) and release notes for version 2.12.2 offer additional context and confirmation of the issue and its fix.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.