VYPR
← All advisories
Critical severity9.0NVD Advisory· Published Feb 25, 2026· Updated Jun 17, 2026

CVE-2026-27822

CVE-2026-27822

Description

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting (XSS) vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an attacker can steal administrator credentials from localStorage, leading to full account takeover and system compromise. Version 1.0.0-alpha.83 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rustfscrates.io
< 1.0.0-alpha.831.0.0-alpha.83

Affected products

84
  • Rustfs/Rustfs83 versions
    cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:*+ 82 more
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9:*:*:*:rust:*:*
    • (no CPE)range: < 1.0.0-alpha.83
  • ghsa-coords
    pkg:cargo/rustfs
    Range: < 1.0.0-alpha.83

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.