CVE-2026-82409

**Component:** Elasticsearch indexer (`indexer/`) **Primary location:** `indexer/common.go:2395-2407` (`serializedDataForUpdateAccounts`) **Entry point:** `SetAccountName` native transaction (contract type 12) — `core/process/transaction/txProcess.go:688` --- ## Description When the node indexes account updates to Elasticsearch, it builds the ES `_bulk` painless-script line by splicing the account's **name** directly into JSON with `fmt.Sprintf("%s", ...)` and **no escaping**: ```go // indexer/common.go:2395-2407 (serializedDataForUpdateAccounts) serializedData := []byte(fmt.Sprintf(`{"script":{"source":"`+ `ctx._source.name = params.name; ... `+ `","lang": "painless","params":`+ `{"name": "%s", "nonce": %d, "rootHash": "%s", "balance": %d, ...}}}`, acc.Name, acc.Nonce, acc.RootHash, acc.Balance, ...)) // acc.Name is RAW ``` `acc.Name` originates from on-chain account state: `indexer/accountInfo.go:31` sets `Name: string(userAccount.GetName())`. An account name is fully attacker-controlled and only weakly validated when it is set on-chain by the `SetAccountName` handler: ```go // core/kapp/accounts/accounts.go:1740 if !utf8.Valid(tc.GetName()) || len(tc.GetName()) > core.MaxNameSize { ... } // MaxNameSize = 100 ``` The only constraints are **valid UTF-8** and **length ≤ 100 bytes**. Double-quote (`"`), backslash (`\`), and newline (`\n`) are all valid UTF-8 and are **not** rejected. The safe helper `converters.JsonEscape()` exists and is used for `_id` fields elsewhere in the same file (`common.go:893`, `:932`, `:961`) but is **not** applied to the name. The resulting buffer is POSTed verbatim to Elasticsearch `_bulk` by `elasticClient.DoBulkRequest` (`indexer/elasticClient.go:128`), with the index in the URL. The `_bulk` body is NDJSON — newline-delimited action/source pairs (`indexer/data/buffer.go:45` appends a `\n` after every entry). Therefore a name containing a quote and newlines can - inject arbitrary keys/structure into the doc