PrivateBin provides a JSON‐LD endpoint that incorporates the raw REQUEST_URI value without escaping, allowing an attacker to insert raw quotation marks into the JSON string. This input–output flaw (CWE‑116) enables the injection of arbitrary key–value pairs into the application/ld+json response, which can result in data tampering, unintended client‑side behavior such as cross‑site scripting, or other malicious use of the crafted structured data. Although direct script execution was not demonstrated, the altered responses can affect consumers that parse the JSON and may be combined with less strict clients to produce more severe outcomes.

Products from the PrivateBin organization running PrivateBin prior to version 2.0.5 are affected. The vulnerability was addressed by the maintainers and fixed in release 2.0.5.

No CVSS score is publicly available for this issue and the EPSS metric is not provided. The vulnerability does not require authentication and can be triggered by any externally reachable HTTP request that delivers a specially crafted REQUEST_URI containing characters such as quotation marks. Because the injected JSON is delivered to clients that consume structured data, an attacker can modify the data seen by browsers, crawlers, or other automated agents. The absence of protective headers such as X‑Content‑Type‑Options, Content‑Security‑Policy, X‑Frame‑Options, and Referrer‑Policy further increases the risk that the injected payload could be executed or misinterpreted by vulnerable consumers.