FR
live
High CVSS 7.3

CVE-2026-18481

NVD analysis in progress

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.

What this means

Exposure
Exploitable remotely over the network and with an ordinary user account — but only if a user opens booby-trapped content.
Impact
An attacker can read sensitive data and modify or destroy data.
Weakness
Attacker-supplied script runs in other users’ browsers (cross-site scripting).
Likelihood
Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.

What to doFold into the next patch cycle.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published
31 July 2026
CVSS
7.3 (v3.1) CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
EPSS
0.28% probability of exploitation within 30 days · above 20% of all CVEs
Weakness
CWE-79
Sources
nvd
References

Type at least two characters.

navigate open esc dismiss