CVE-2026-92784
@refinedev/inferencer through 7.0.0 Code Injection via API Field Names
- State
- Published
- Severity
- 7.7 High
- Published
- Sep 16, 2026
- Updated
- Sep 17, 2026
- Reserved
- Sep 16, 2026
Description
@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.7 High | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
@refinedev/inferencerrefinedev |
|
References
- GitHub Issue #7556issue-tracking
- https://github.com/refinedev/refineproduct
- the field key is interpolated into the generated JSX attribute unescapedtechnical-description
- fields are inferred from Object.keys of the API recordtechnical-description
- VulnCheck Advisory: @refinedev/inferencer through 7.0.0 Code Injection via API Field Namesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.