Medium 5.4

VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that...

CVE-2026-54380 First seen on SecPulse Nov 5, 07:10

Affected packages

Ecosystem	Package	Affected	Fixed
Shenzhen Shine Industrial Co., Ltd.	VitaFit	< 2026-10-30	2026-10-30

Original description The description as published by the source.

VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the application's failure to restrict scripts or force downloads for image/svg+xml content, causing the JavaScript to execute when a victim opens the file via direct browser navigation.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.4; CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4: Medium 5.1; CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Published: Nov 5, 2026
First seen on SecPulse: Nov 5, 07:10
GHSA: GHSA-mcvv-pcqf-fqr2
CWE: CWE-79

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

JavaScript

Attack Types

Cross-Site Scripting

CWE

CWE-79

All

Shenzhen Shine Industrial Co Ltd Vitafit

Detection sources

NIST National Vulnerability Database00:15
GitHub Security Advisories (Global)Nov 5, 09:33
CVE.org (CVE Program・cvelistV5)Nov 5, 07:10