Vulnerability in facturascripts/facturascripts (CVE-2026-45710)
Summary
Vulnerability in facturascripts/facturascripts (CVE-2026-45710). Risk of unauthorized operations or information disclosure. Exploitable via referencia.
Original description
The description as published by the source.
Summary
WidgetVariante::renderVariantList (Core/Lib/Widget/WidgetVariante.php:298-330) and WidgetSubcuenta::renderSubaccountList (Core/Lib/Widget/WidgetSubcuenta.php:290-321) build the `` row for each modal hit by concatenating the user-controlled referencia / codsubcuenta field directly into a single-quoted JavaScript string literal inside an HTML onclick attribute. The defender's intuition is that Tools::noHtml (called in Variante::test() and Subcuenta::test()) replaces ' with the HTML entity ', neutralising the JavaScript string break. The intuition is wrong: HTML attribute parsing decodes character references before the JavaScript fragment is parsed, so ' becomes a literal ' in the JavaScript context. An attacker who can store a value such as 1',alert(1),'2 in Variante.referencia (no special characters required, just one apostrophe) ends up with widgetVarianteSelect('id', '1',alert(1),'2'); executing in any user's browser the moment they open the variant-picker modal.
The recent 40bc701 and 8586b97 fixes corrected the same anti-pattern in three sister classes by switching to data-reference="..." + this.dataset.reference. The two widget classes audited here were missed by that fix wave.
Details
the offending code
Core/Lib/Widget/WidgetVariante.php:298-330:
protected function renderVariantList(): string
{
$items = [];
foreach ($this->variantes() as $item) {
$match = $item->{$this-…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-45710 has been found in facturascripts/facturascripts.
Attackers can target a specific entry point like referencia over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "facturascripts/facturascripts CVE-2026-45710" on the vendor's site.
CVE-2026-45710 (facturascripts/facturascripts) — CWE-116
Attack vector: remote (network-reachable)
Attack surface: referencia / codsubcuenta / onclick / Variante.referencia
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-116) exists in facturascripts/facturascripts. Attackers reach the vulnerable code path via referencia.
Check the vendor advisory for the affected versions of facturascripts/facturascripts. Attack surface: referencia / codsubcuenta / onclick / Variante.referencia.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'facturascripts/facturascripts' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'facturascripts/facturascripts' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
facturascripts/facturascriptsを grep し、稼働しているサービス・バージョンを把握する。 -
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- JVN JVNDB-2026-025872
- package github.com
- web github.com
- web github.com