EUVD-2026-42252
GHSA-pjwf-764c-cr9c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered stored injection (AV:N, AC:L), requires low-privilege auth (PR:L), victim must view the page (UI:R), scope changes to victim browser (S:C), limited confidentiality/integrity impact via phishing redirect (C:L/I:L), no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content. Attackers can craft payloads in the organization name field to redirect users to untrusted websites, enabling phishing attacks and reputational damage.
AnalysisAI
HTML injection in Capgo's organization settings endpoint allows an authenticated attacker to embed malicious HTML into the organization name field, redirecting other users to attacker-controlled phishing sites. Affected versions are all Capgo releases prior to 12.128.2. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the attack path is low-complexity for any user with organization settings write access.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-Site Scripting) covers this class of flaw: user-supplied input accepted by the organization name field is not sanitized or encoded before being rendered to other users' browsers. Although tagged as 'HTML injection' rather than classic reflected or stored XSS, the root cause is identical - failure to escape or validate HTML metacharacters at an output rendering point. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A) confirms the vulnerability is exploitable over the network by a low-privileged authenticated user, but requires active user interaction (a victim must view the rendered organization name). Capgo is a live-update/over-the-air (OTA) update platform built for Capacitor mobile applications; its web dashboard allows team members to configure organization metadata, making the organization name a persistent, shared-view surface susceptible to stored HTML injection.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which resolves the HTML injection by properly sanitizing or encoding the organization name field before rendering. The vendor-confirmed fix is documented at https://github.com/Cap-go/capgo/security/advisories/GHSA-vhvc-gxfh-m85g. If immediate upgrade is not possible, restrict organization settings write access to the minimum number of trusted users as a compensating control - this limits who can inject malicious content, though it does not eliminate the underlying vulnerability. Additionally, operators can monitor organization name fields via audit logs for unexpected HTML tags or URL-like strings as a detection measure. Note that restricting write access may impact legitimate workflow for teams that rely on self-service organization management.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today