EUVD-2026-31942Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in remediation verification file preview flows. User-supplied filename values are persisted and then rendered into HTML and attribute contexts without output encoding, allowing attacker-controlled JavaScript to execute in the browser of any user who opens the affected verification/remediation views. Because the payload is stored server-side and rendered to other users, exploitation is persistent and can impact privileged accounts. This vulnerability is fixed in 1.8.3.
AnalysisAI
Stored cross-site scripting in Faction penetration testing platform versions prior to 1.8.3 allows authenticated users to inject JavaScript via crafted attachment filenames in remediation verification flows, which then executes in the browser of any user viewing the affected verification or remediation views. With CVSS scope-changed impact (S:C) and high confidentiality and integrity impact, exploitation can hijack privileged manager or assessor sessions; no public exploit identified at time of analysis and EPSS sits at 0.03% (10th percentile).
Technical ContextAI
Faction (cpe:2.3:a:factionsecurity:faction) is a Java-based PenTesting Report Generation and Collaboration Framework used by security teams to author and share assessment findings. The root cause is CWE-79 - improper neutralization of input during web page generation - specifically, user-supplied attachment filenames are persisted server-side and then concatenated into both HTML body and HTML attribute contexts during file-preview rendering without context-appropriate output encoding. The 1.8.3 release notes confirm the fix introduces escapeHtml4 for attribute contexts, escapeJson for JSON string contexts, and URLEncoder for URL parameter contexts, plus a server-side whitelist (alphanumeric, spaces, dots, hyphens, underscores) that rejects uploads containing HTML or script characters.
RemediationAI
Vendor-released patch: upgrade to Faction 1.8.3 or later, available at https://github.com/factionsecurity/faction/releases/tag/1.8.3 (advisory GHSA-x3fm-rrxj-rg66). The 1.8.3 release applies context-appropriate output encoding (escapeHtml4 for HTML attributes, escapeJson for JSON, URLEncoder for URL parameters) and adds server-side filename validation rejecting non-whitelisted characters. If immediate upgrade is impossible, restrict the Faction instance to trusted assessors only by tightening network ACLs and review existing remediation/verification attachments for suspicious filenames containing angle brackets, quotes, or 'on*=' handlers; deleting or renaming offending records purges the stored payload. Note that filename-rename mitigation only works while the upgrade is pending - the underlying rendering paths remain unsafe until 1.8.3 is installed, and a strict Content-Security-Policy at the reverse proxy (e.g. script-src 'self') can reduce exploitability of any residual injection but may break legitimate inline scripts in the Faction UI.
FACTION is a PenTesting Report Generation and Collaboration Framework. Rated critical severity (CVSS 9.6), this vulnerab
Unauthenticated authorization bypass in FACTION pentesting report framework prior to 1.8.3 allows remote attackers to re
Stored cross-site scripting in Faction (a penetration testing report generation and collaboration framework) versions pr
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today