CVE-2026-102667

8.3 HIGH

Published 2026-10-01 · Updated 2026-10-07

AI risk analysis

Summary: The Joyland AI app allows attackers with shared network access to inject JavaScript, potentially leading to unauthorized access to sensitive data and device resources.
Exploitability: Exploitation requires shared network access and could be feasible for attackers with network proximity to the target device.
Blast radius: If exploited, the impact could be severe, allowing full access to the device’s file system, camera, microphone, and GPS, posing a significant risk to user privacy and device security.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Disable the WebView feature in the Joyland AI app or restrict network access to the app to prevent unauthorized JavaScript injection.

webjs-injectionnetwork-accessprivacy

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed app has been granted permissions previously, the attacker can access the entire file system, camera, microphone, and GPS tracking.

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-749

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.