Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-76203 ·
Medium · August 19, 2026

CSS sanitizer bypass in Pentestify report themes allows forced outbound requests from users' browsers

S0
Secur0 CNA
CVE-2026-76203

Description

Incorrect Behavior Order: Validate Before Canonicalize (CWE-180) in sanitize_css_source() (backend/schemas.py), reachable through POST /api/themes and PUT /api/settings, in Pentestify 1.2.0 through 2.3.2 inclusive, which allows an authenticated user holding no privileged role to force outbound HTTP requests from any other user's browser to a host under their control by means of a report theme whose custom_css reconstructs the url( function using CSS hex escapes (\75 rl(...)), because the sanitizer applies a literal-substring blocklist to text that has not been canonicalized (re.sub(r'url\(([^)]*)\)', _url, css, flags=re.IGNORECASE)) while the browser tokenizer resolves the escapes before it recognizes the function, unlike is_safe_image_src() in the same file, which validates image sources against an anchored allowlist (^data:image/...$). The stored CSS applies across the whole installation because report_theme is a single-row global setting and PUT /api/settings requires only Depends(auth.require_auth), and it is injected through styleEl.textContent in injectThemeStyles() (js/app.js), so no JavaScript executes by this path. This results in disclosure of the IP address and User-Agent of every user who logs in and loads the application, to a server controlled by the attacker, with no further action on the victim's part.

Vulnerability type (CWE)

CWE-180: Incorrect Behavior Order

Affected versions

Pentestify from 1.2.0 through 2.3.2 inclusive. The flaw was introduced together with the free CSS editor for report themes (commit 7c5e4c8, APP_VERSION 1.2.0): earlier versions carry no custom_css field and are not affected. Tagged releases v2.0.0, v2.2.0, v2.3.0 and v2.3.2 carry the flaw; v1.1.1 does not. The fix (1ed1aad) does not change APP_VERSION, which remains 2.3.2, and is not tagged: as of this advisory no published version or tag carries the fix. Default status: unaffected.

Score (CVSS 4.0)

Medium (5.1)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Solution

No fixed version has been released yet. Apply commit 1ed1aad, which canonicalizes CSS escapes (\XX hex and \X literal) before the blocklist runs, or upgrade to the first published version that carries it. Themes already stored are not re-sanitized on upgrade: review the custom_css of existing themes and the report_theme value in the global settings, and delete any theme containing CSS escapes.

Patch

Commit 1ed1aad

Credits

  • Manuel Martínez Casasola - finder
  • Xoán M. Otero Jorge - analyst
  • Secur0 CNA - coordinator
  • Mario Álvarez Fernández - remediation developer Discovery source: External Official record: CVE-2026-76203