Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-19744 ·
Medium · August 13, 2026

Stored Cross-site Scripting in Pentestify allows JavaScript execution via Markdown links in report fields

S0
Secur0 CNA
CVE-2026-19744

Description

Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) (CWE-79), stored, in the frontend Markdown renderer (markdownToHtml, js/app.js), exposed in the finding and report text fields and rendered in the report Preview view, in Pentestify 2.3.1, which allows an authenticated user to execute arbitrary JavaScript in the application origin via a Markdown link containing a double quote in its URL, because the function's sanitization step escapes &, < and > but not quotes (js/app.js:592), while the link conversion step interpolates the URL inside an anchor's href attribute (js/app.js:601), so a double quote in the URL closes the attribute and allows arbitrary event handlers to be added to the element, whose resulting HTML is inserted through innerHTML with no further sanitization. The defect sits in a single sanitization point shared by every field rendered through that function: description, poc, impact, remediation and retest_notes on findings, and incidents_text, audit_summary, tests_performed, recommended_solutions and methodology_notes on the report. This results in arbitrary JavaScript execution in the application origin, in the browser of the user viewing the report. The application's session cookie is issued with the HttpOnly attribute and is not accessible from script.

Vulnerability type (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected versions

Pentestify before 2.3.2 (fixed in 2.3.2 by commit 272f7d6, dated 2026-07-17). The markdownToHtml function was introduced in commit e421fcc (2026-06-27), at version 2.1.0, and the sink was present in the v2.2.0 and v2.3.0 tags, so tagged releases did ship in a vulnerable state. Versions are read from the APP_VERSION constant in js/app.js. Default status: unaffected.

Score (CVSS 4.0)

Medium (5.1)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Solution

Upgrade to version 2.3.2 or higher.

Patch

Commit 272f7d6

Credits

  • Jaime Ramírez - finder
  • Xoán M. Otero Jorge - analyst
  • Secur0 CNA - coordinator
  • Mario Álvarez Fernández - remediation developer Discovery source: External Official record: CVE-2026-19744