{"id":"CVE-2026-73537","state":"PUBLISHED","title":"Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component (WebView) running","description":"Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component (WebView) running on the affected product, resulting in the displayed content being altered.","publishedAt":"2026-08-21T07:23:17.939Z","updatedAt":"2026-08-21T12:44:53.558Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","source":"jpcert"},"assigner":"jpcert","products":["Japan Science and Technology Agency (JST) Miraikan Assist App Android version","Japan Science and Technology Agency (JST) Miraikan Assist App iOS version"],"affected":[{"vendor":"Japan Science and Technology Agency (JST)","product":"Miraikan Assist App Android version","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.1.7","versionType":"semver"}]},{"vendor":"Japan Science and Technology Agency (JST)","product":"Miraikan Assist App iOS version","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.0.7","versionType":"semver"}]}],"references":["https://www.miraikan.jst.go.jp/en/news/general/202608194709.html","https://jvn.jp/en/jp/JVN09266484/"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/73xxx/CVE-2026-73537.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-73537","state":"PUBLISHED","datePublished":"2026-08-21T07:23:17.939Z","dateUpdated":"2026-08-21T12:44:53.558Z","assignerShortName":"jpcert","assignerOrgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateReserved":"2026-08-18T01:05:43.517Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component (WebView) running on the affected product, resulting in the displayed content being altered."}],"affected":[{"vendor":"Japan Science and Technology Agency (JST)","product":"Miraikan Assist App Android version","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.1.7","versionType":"semver"}]},{"vendor":"Japan Science and Technology Agency (JST)","product":"Miraikan Assist App iOS version","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.0.7","versionType":"semver"}]}],"references":[{"url":"https://www.miraikan.jst.go.jp/en/news/general/202608194709.html"},{"url":"https://jvn.jp/en/jp/JVN09266484/"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_0":{"version":"3.0","baseSeverity":"MEDIUM","baseScore":4.7,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"}},{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV4_0":{"version":"4.0","baseSeverity":"MEDIUM","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"Cross-site scripting (XSS)","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"jpcert","orgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateUpdated":"2026-08-21T07:23:17.939Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-21T12:43:43.972426Z","id":"CVE-2026-73537","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-21T12:44:53.558Z"}}]}}}