Description

Stored Cross-site Scripting (CWE-79) in the client-side rendering functions renderPreview(), renderEditor(), and renderAuditData() in js/app.js in Pentestify <1.1.0, which allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who opens a report, because the values of a finding's images array and a report's client_logo array are interpolated directly into the src attribute of <img> tags via template literals without escaping (for example <img src="${img}">), unlike text fields, which are passed through the application's escapeHTML() helper. An attacker stores a payload such as x" onerror="..." through the REST API (POST /api/reports/{id}/findings); it is persisted unsanitized and executed when any other user, including administrators, views the affected report. This results in the execution of arbitrary JavaScript in the application context in the victim's browser.

Vulnerability type (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)

Affected versions

Pentestify before 1.1.0 (all versions prior to 1.1.0, including 1.0.0). The flaw has been present since before the 1.0.0 release and was fixed in 1.1.0. Default status: unaffected.

Score (CVSS 4.0)

Medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N

Solution

Upgrade to version 1.1.0 or higher.

Patch

Commit a058a22

Credits

• Marcos García (s3ntinl) - finder
• Mario Álvarez Fernández - analyst and remediation developer
• Xoán M. Otero Jorge - analyst
• Secur0 CNA - coordinator Discovery source: External Official record: CVE-2026-59238