Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-19434 ·
Medium · August 11, 2026

Stored Cross-site Scripting in Pentestify allows JavaScript execution via the finding severity field

S0
Secur0 CNA
CVE-2026-19434

Description

Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) (CWE-79), stored, in the frontend finding renderer (js/app.js) and in the FindingBase and FindingTemplateBase input schemas (backend/schemas.py), exposed at POST /api/reports/{report_id}/findings and rendered in the report's Edit and Preview views, in Pentestify 2.3.0, which allows an authenticated user to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, because that field was declared as str with no validator and no allowlist (backend/schemas.py:86 and :329), was persisted verbatim, and was interpolated raw by the frontend into class and style attributes without escaping (js/app.js:1552, :2823, :2876 and :2883), so a value closing the attribute with "> escapes the attribute context and allows arbitrary elements to be injected into the DOM, unlike the same finding's title and description fields, which the project already passed through its escapeHTML() function before rendering. This results in arbitrary JavaScript execution in the application origin when the report is rendered. The supplied proof of concept demonstrates that the backend accepts and stores the value without validation and that the injected markup executes when the report is opened: it does not demonstrate session access or data exfiltration.

Vulnerability type (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected versions

Pentestify before 2.3.1 (fixed by commit 8e81053, dated 2026-07-17). The fixing commit did not modify the version constant, which remained at 2.3.0; the first version containing the fix is 2.3.1, set by the immediately following commit 9deca77. The v2.3.0 tag shipped in a vulnerable state. Version 2.3.1 carries no git tag: the earliest tag containing the fix is v2.3.2. Versions are read from the APP_VERSION constant in js/app.js. Default status: unaffected.

Score (CVSS 4.0)

Medium (5.1)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Solution

Upgrade to version 2.3.1 or higher. The fix was not tagged: the earliest tagged release containing it is v2.3.2.

Patch

Commit 8e81053

Credits

  • Marcos García (s3ntinl) - finder
  • Cristian Fernández Cornejo - analyst
  • Xoán M. Otero Jorge - analyst
  • Secur0 CNA - coordinator
  • Mario Álvarez Fernández - remediation developer Discovery source: External Official record: CVE-2026-19434