EUVD-2026-45947
GHSA-hpcr-c79h-7cww
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Storing the payload requires authenticated access (PR:L), a victim must open the report (UI:R), and XSS executes in the victim's browser context outside the application's security domain (S:C).
Primary rating from Vendor (Secur0).
CVSS VectorVendor: Secur0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an <img> src attribute without escaping.
AnalysisAI
Stored cross-site scripting in maalfer Pentestify before 1.1.0 allows an authenticated attacker to inject arbitrary JavaScript that executes in the browser of every user who views an affected report. The payload is stored in a finding's images array or a report's client_logo array and interpolated directly into HTML img src attributes by the client-side rendering functions renderPreview, renderEditor, and renderAuditData in js/app.js without HTML escaping. No public exploit has been identified and this vulnerability is not listed in CISA KEV; however, the stored nature means a single injection persists and fires for all future viewers of the affected report until the application is patched.
Technical ContextAI
Pentestify (CPE: cpe:2.3:a:maalfer:pentestify:*:*:*:*:*:*:*:*) is a web-based penetration testing report management tool built on a Python/FastAPI backend and a JavaScript frontend. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant, where attacker-controlled strings are persisted to a database and later rendered without sanitization. The root cause is dual: the backend schemas.py accepted arbitrary string values in the images and client_logo JSON array columns without allowlisting, and the frontend js/app.js used ES6 template literals to interpolate those values directly into img src attributes - for example, the literal string <img src="${img}"> - with no call to escapeHTML() or equivalent. The fix (commit a058a22) addresses both layers: schemas.py now enforces a strict data URL regex (^data:image/[a-zA-Z0-9.+-]+;base64,[A-Za-z0-9+/=\s]+$) via Pydantic field validators, the import path in main.py runs a post-import sanitization pass over existing database rows, and the three render functions in js/app.js now wrap each interpolated value in escapeHTML().
RemediationAI
Upgrade to Pentestify 1.1.0, which is the vendor-confirmed fix version per commit a058a22b42c6311895622645265df79a60265b1d at https://github.com/maalfer/pentestify/commit/a058a22b42c6311895622645265df79a60265b1d. The fix hardens both the storage layer (backend Pydantic validators now reject any image value that is not a valid base64 data URI) and the rendering layer (escapeHTML() is applied to all img src interpolations in js/app.js). Notably, the import_database endpoint also received a post-import sanitization pass, meaning databases imported from pre-1.1.0 instances will be cleaned on import. If immediate upgrade is not possible, a compensating control is to restrict write access to findings and reports to only fully trusted, internally vetted accounts, since the attacker must be authenticated to store the payload - this reduces but does not eliminate the attack surface and introduces an operational trade-off by limiting collaborative reporting workflows. Reviewing all existing findings and reports for suspicious non-data-URI strings in the images and client_logo columns prior to upgrade is also advisable.
More in Pentestify
View allServer-Side Request Forgery in Pentestify's PDF export pipeline allows authenticated users to induce the server-side hea
Stored cross-site scripting in Pentestify's finding renderer allows any authenticated user with finding-creation privile
CSS sanitizer bypass in maalfer Pentestify 1.2.0-2.3.2 allows an authenticated low-privilege user to inject CSS that vic
Stored cross-site scripting in the Markdown renderer of maalfer Pentestify before v2.3.2 allows authenticated users to i
Stored XSS in Pentestify's user management component (all versions before 1.1.1) enables an authenticated attacker to ex
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today