What is CVE-2026-17528?
CVE-2026-17528 is a Cross-site Scripting (XSS) vulnerability in `nice-select2` versions before 2.4.1, exploitable via the `select` element. An attacker can inject a malicious payload rendered directly into the DOM without proper sanitization, leading to arbitrary script execution in the victim's browser. Users should immediately upgrade to version 2.4.1 or later.
Azərbaycanca: CVE-2026-17528 `nice-select2` kitabxanasının 2.4.1-dən əvvəlki versiyalarında `select` elementi vasitəsilə Cross-site Scripting (XSS) zəifliyidir. Təcavüzkar düzgün təmizlənməmiş zərərli DOM yükü ilə qurbanın brauzerində ixtiyari skript icra etdirə bilər. İstifadəçilər dərhal 2.4.1 və ya daha yuxarı versiyaya yeniləməlidir.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
Through which component is CVE-2026-17528 exploited?
This vulnerability is exploited via the `select` element.
What should users do to mitigate CVE-2026-17528?
Users should immediately upgrade the `nice-select2` library to version 2.4.1 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.