CVE-2026-97871 is a high severity (CVSS 7.3) code injection flaw in Zhonglun CloudPos up to version 3.0.1.76, in the JSBridge component. The record says the exploit is public and the vendor did not respond, so no fix is known. Reduce exposure now and ask the vendor for a patch.
What's affected
The record covers Zhonglun CloudPos up to and including 3.0.1.76. The affected function is OpenLocalBrowser in the file ZlPos/ZlPos/Bizlogic/JSBridge.cs, in the JSBridge component. The weak point is the url argument, which is handled in a way that lets injected content be treated as code.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L with a score of 7.3. The record says the attack can be executed remotely, that the exploit has been disclosed publicly and may be used, and that the vendor was contacted early but did not respond in any way.
There is no fixed version in the record. We could not retrieve the researcher write-up or the VulDB page when preparing this post, so there is no confirmed patched release. Ask Zhonglun directly and treat any claim of a fix as unverified until you can see the release notes. The KEV flag in the record is false.
How to check if you're exposed
Find out whether CloudPos is installed in your environment. It is a point of sale product, so look at store systems, back office machines and any software inventory or endpoint management tool you use. The product version is normally shown in the application's About screen. Anything at 3.0.1.76 or earlier is in scope.
Then work out how the JSBridge component is exposed. The record rates the attack as network based, so ask where CloudPos terminals sit on your network and whether they can be reached from untrusted segments. Your network team can tell you quickly.
There are no vendor steps to follow because no advisory was available. If you have a contact at the vendor or the reseller, ask for one in writing.
What to do now
- Inventory every CloudPos installation and record the exact version.
- Segment point of sale systems so that only the services that must talk to them can do so. Block inbound access from general user and guest networks.
- Contact Zhonglun or your reseller, ask for a fixed version and for written confirmation of which versions are affected.
- Increase monitoring on affected machines, for example endpoint alerts on unexpected child processes launched by the CloudPos application.
- If the vendor stays silent, make a risk decision about replacing the product or isolating it more strictly, and record that decision.
Why it matters
The weakness types are CWE-74, CWE-94. Code injection happens when data supplied to a program is interpreted as instructions. In this case the data is a url value handed to a function that opens a local browser from inside the application bridge. Bridges between an embedded browser and native code are powerful by design, which is why they need strict checks on what is passed across.
The practical problem here is the missing vendor response. When a flaw is public and there is no patch, defenders have only compensating controls. That makes asset inventory and network segmentation the real mitigation, and it is a reminder to ask suppliers about their vulnerability handling before you buy.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It covers packages and libraries your projects pull in, so it will not see a standalone application or a kernel, but it is a quick way to find out which third party components you are carrying at all. Reachability analysis then helps you separate vulnerable code that your application actually calls from code that only sits in a dependency tree.
Quick check
Is there a patch for CVE-2026-97871?
The record says the vendor did not respond, and we found no fixed version. Check with Zhonglun for current information before assuming anything is fixed.
Is CVE-2026-97871 on the CISA KEV list?
No. The record shows kev as false. The record does state that a public exploit exists, so treat it as a realistic risk anyway.
Sources
Gold entry for CVE-2026-97871 VulDB entry, returned an access error when we tried to read it Researcher issue tracker entry, listed in the record, not read NVD record data for CVE-2026-97871
Last reviewed: 18 October 2026.
