EUVD-2026-42371Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered, no auth required (PR:N), scope change to victim browser (S:C), high confidentiality risk from credential theft, low integrity for page content manipulation.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malicious pushes containing data:text/html URIs that execute arbitrary JavaScript in victims' browsers when clicked, enabling phishing and credential theft under the trusted PasswordPusher domain.
AnalysisAI
Cross-site scripting via data URI injection in PasswordPusher before 2.8.1 allows unauthenticated attackers to create URL pushes containing data:text/html payloads that execute arbitrary JavaScript in victims' browsers under the trusted PasswordPusher origin. The root cause is the valid_url function accepting data: URI schemes as valid URLs, meaning any attacker with push creation access can craft a link that, when clicked by a recipient, renders attacker-controlled HTML and JavaScript within the trusted application domain - enabling convincing phishing pages or session cookie harvesting. No public exploit has been identified at time of analysis, but a vendor-released patch (2.8.1) is available per the GitHub security advisory.
Technical ContextAI
PasswordPusher is an open-source web application (cpe:2.3:a:passwordpusher:passwordpusher:*:*:*:*:*:*:*:*) designed for one-time, expiring sharing of sensitive data including URLs and passwords. The vulnerable component is the valid_url server-side validation function, which enforces an allowlist of acceptable URL formats per CWE-183 (Permissive List of Allowed Inputs). The function fails to explicitly reject data: URI schemes - a browser feature that allows embedding raw content (HTML, JavaScript, images) directly inside a URI (e.g., data:text/html,<script>alert(1)</script>). Because PasswordPusher treats such URIs as valid URL push payloads and renders the destination as a clickable link, a victim's browser interprets the data URI natively when clicked, executing embedded JavaScript within the PasswordPusher domain context. This constitutes a stored, DOM-delivered XSS/content injection primitive that bypasses same-origin protections because the attack leverages the trusted domain itself as the delivery mechanism.
RemediationAI
The primary remediation is upgrading to PasswordPusher 2.8.1 or later, which introduces proper rejection of data: URI schemes in the valid_url validation function. The fix is documented in the vendor GitHub security advisory at https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-76c2-66pg-fj2f. For operators unable to patch immediately, a compensating control would be to disable anonymous (unauthenticated) push creation if the platform supports authentication-gating of push submissions, which raises the attacker barrier from PR:N to PR:L or higher and limits the attacker population to authenticated users. Note that this does not eliminate the vulnerability - an authenticated malicious insider could still exploit it - but substantially reduces external attack surface. Additionally, organizations relying on PasswordPusher in automated IT workflows should brief recipients not to click push links from unexpected senders until patching is complete, given the phishing potential of this flaw.
More in Passwordpusher
View allPassphrase brute-force in PasswordPusher before 2.9.2 lets remote attackers who possess a push token recover the passphr
PasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous password pushes by exploiting a nil-
Unauthenticated attackers can create file-type pushes through Password Pusher's JSON API endpoints when the application
Same weakness CWE-183 – Permissive List of Allowed Inputs
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today