Vulnerability · Published Oct 1, 2026 · Assigned by cisa-cg

CVE-2026-102667Joyland AI WebView command injection

High 8.3

In plain English

A high-severity security flaw in Joyland.ai from Joyland. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.2%top 91.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed app has been granted permissions previously, the attacker can access the entire file system, camera, microphone, and GPS tracking.

Affected products (as reported)

Vendor	Product	Versions
Joyland	Joyland.ai	*

Weakness: CWE-749 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

url third-party-advisory
url vdb-entry