CVE-2026-77166

CVE-2026-77166

Low · published September 21, 2026

CVSS v3.0
2.4
EPSS
0%
Percentile
19.9
In the wild
Unconfirmed
What it is

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

The record
Technical detail
CVSS v3.0
2.4 · LOW
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00284 · 19.9th percentile
Published
2026-09-21T20:17Z
References (2)
https://hackerone.com/reports/3599470 · [email protected]https://hackerone.com/reports/3599470 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 23 SEP 03:48Z
    EPSS moved — → 0%
    epss
  • 21 SEP 15:25Z
    The emoji field in the page emoji update endpoint does not properly validate user input
    cvelistv5