What’s Vulnerable › Vulnerabilities

CVE-2026-27639: Mercator vulnerable to stored XSS via unescaped Blade directives in display templates

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-25 · updated 2026-06-17
• Weakness: CWE-79

Description

Mercator is an open source web application designed to enable mapping of information systems. A stored Cross-Site Scripting (XSS) vulnerability exists in Mercator prior to version 2026.02.22 due to the use of unescaped Blade directives (`{!! !!}`) in display templates. An authenticated user with the User role can inject arbitrary JavaScript payloads into fields such as "contact point" when creating or editing entities. The payload is then executed in the browser of any user who views the affected page, including administrators. Version 2026.02.22 fixes the vulnerability.

Affected products

• sourcentis mercator: before 2026.02.22 — fixed in 2026.02.22

How to fix

Upgrade to a fixed version: sourcentis mercator 2026.02.22. Check the vendor advisory for mitigations.

References

• https://github.com/dbarzin/mercator/commit/839d231399944e43a865198262e96e0218252cc3
• https://github.com/dbarzin/mercator/commit/9902ffd91f287e474729f514c77261f4ef7db8fe
• https://github.com/dbarzin/mercator/commit/c58bb1d2fff18605c61d93cfaf77adca416c560a
• https://github.com/dbarzin/mercator/security/advisories/GHSA-65p7-pph2-966g

Get alerted when CVE-2026-27639 or the next vulnerability affects your stack