← Back to Vulnerability Reports CVE Intelligence

CVE-2026-42141

See advisory•HIGH · CVSS 7.7•No exploitation reported

What is CVE-2026-42141?

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can be exploited to scan internal infrastructure, access local cloud metadata endpoints (e.g., AWS IMDS), interact with internal services that lack authentication, or exfiltrate data. This vulnerability is fixed in 4.4.1.

CVSS7.7 NVD 3.1

SeverityHIGH

ExploitationNo exploitation reported

EPSS<1% · P31

Triage statusNo Known Exploit

ActionPatch this week

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CWECWE-918

NVD published2026-05-12

NVD last modified2026-10-26

Timeline

2026-05-12Published to the U.S. National Vulnerability Database (NVD)
2026-10-26NVD record last updated

Affected product

See advisory

Remediation Steps

Audit all dependencies on TanStack npm package and identify affected versions in software bill of materials (SBOM)
Update TanStack to patched version and rebuild all dependent applications
Scan development environments and CI/CD pipelines for malware artifacts from Mini Shai-Hulud campaign
Review employee device access logs for unauthorized activities corresponding to infection timeline
Implement npm package integrity verification and code signing validation in supply chain

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 3 of May 2026 (May 18 – 24)

Related vulnerabilities

CVE-2026-96652 – Plex Media Server (same weakness: CWE-918)
CVE-2026-96655 – Plex Media Server (same weakness: CWE-918)
CVE-2026-64849 – Lfprojects Mlflow (same weakness: CWE-918)
CVE-2026-15409 – SonicWall SMA1000 Appliances (same weakness: CWE-918)
CVE-2026-20230 – Cisco Unified Communications Manager (same weakness: CWE-918)
CVE-2026-33626 – Internlm Lmdeploy (same weakness: CWE-918)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.