GitHub advisory GHSA-p8gx-753q-v89p
Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection
MediumCVSS 6.1ui5/webcomponents-base
- CVE(s)
- CVE-2026-44767
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products and versions
- Library ui5/webcomponents-base
Versions: ui5 webcomponents-base < 2.21.0
Appears in
Patch Days listing this note, newest first.
- July 2026NewMediumCVSS 6.1