Package vulnerability, severity high

adminneo-org/adminneo: AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

Published October 30, 2026, updated October 31, 2026

AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass). Source: GHSA-rx7m-wxwq-vxr9 (CVE-2026-96632).

What's affected

• adminneo-org/adminneo (packagist)<5.5.1

What to do

1. Upgrade adminneo-org/adminneo to 5.5.1 or later.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident ghsa-rx7m-wxwq-vxr9

References

• https://osv.dev/vulnerability/GHSA-rx7m-wxwq-vxr9
• https://github.com/adminneo-org/adminneo/security/advisories/GHSA-rx7m-wxwq-vxr9
• https://github.com/vrana/adminer/security/advisories/GHSA-h6jr-7pr6-grgj
• https://github.com/adminneo-org/adminneo/commit/2c86406808bc2517efb35f5595b3a05761c2eacd
• https://github.com/adminneo-org/adminneo
• https://github.com/adminneo-org/adminneo/releases/tag/v5.5.1

Notice ghsa-rx7m-wxwq-vxr9, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.