CVE-2026-108802 y_project CVE debrief

Who should care

Defenders responsible for y_project RuoYi systems, particularly those using versions up to 4.8.3, should assess their exposure and potential impact. Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the potential impact on their systems, particularly for y_project RuoYi systems using versions up to 4.8.3. This includes operators, platform administrators, vulnerability management teams, and security 1

Why it matters

Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the potential impact on their systems, particularly for y_project RuoYi systems using versions up to 4.8.3.

• Cross-site scripting attacks may be performed remotely
• The exploit has been made available to the public and could be used for attacks
• Defenders should verify the presence of this vulnerability in their inventory

Technical summary

The vulnerability affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview in y_project RuoYi up to 4.8.3. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the potential impact on their systems, particularly for y_project RuoYi systems using versions up to 4.8.3.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the potential impact on their systems.

Recommended defensive actions

• Verify the presence of this vulnerability in your inventory
• Assess the potential impact on your systems
• Consider applying patches or mitigations if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, affected versions, and potential attack vectors. Defenders should verify the presence of this vulnerability in their inventory and assess the potential impact on their systems, particularly for y_project RuoYi systems using versions up to 4.8.3. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.