EUVD-2026-57219
GHSA-xx2h-7258-xw7c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because the attacker requires a reporter-level account to store the payload; S:C and UI:R because execution occurs in the victim's browser scope upon page load.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records.
Values from containers.cna.references[].tags[] were directly interpolated into HTML badge elements and the resulting string was wrapped in markupsafe.Markup. Because Markup marks the generated content as safe, Jinja's automatic HTML escaping was bypassed.
An authenticated user with permissions to create or modify vulnerability records, such as a user holding the vulnerability:create or vulnerability:modify permission, could submit a crafted reference tag through the CNA API containing arbitrary HTML or JavaScript-capable markup.
The malicious value would subsequently be stored as part of the vulnerability record. When another user visited the corresponding public /cve/<id> or /vuln/<id> page, the crafted tag would be rendered as HTML in the viewer's browser. This could result in JavaScript execution in the security context of the Vulnerability-Lookup application.
Successful exploitation could allow an attacker to perform actions in the context of a victim, access information available to the victim's browser session, or modify page content. As the affected vulnerability pages can be accessed publicly, exploitation may affect users who are not authenticated.
The issue was corrected by applying markupsafe.escape() to each reference tag before inserting it into the HTML badge markup, while retaining Markup only for the static HTML scaffolding.
AnalysisAI
Stored cross-site scripting in Vulnerability-Lookup's render_tag_badges Jinja filter allows an authenticated user holding the vulnerability:create or vulnerability:modify permission to persist arbitrary JavaScript in public vulnerability record pages by submitting crafted reference tags via the CNA API. The flaw stems from markupsafe.Markup being applied to attacker-controlled tag values before HTML escaping, effectively suppressing Jinja's automatic sanitization and causing the payload to execute in any visitor's browser - including unauthenticated users - upon page load. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Write-side exploitation requires an authenticated account holding either the vulnerability:create or vulnerability:modify permission within the Vulnerability-Lookup application - this is the concrete prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N) warrants close reading: the PR:N metric reflects that victims require no privileges to trigger execution simply by visiting a page, but the write-side prerequisite - a vulnerability:create or vulnerability:modify account - means the attacker role is not anonymous. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a vulnerability:create account on a target Vulnerability-Lookup instance submits a new vulnerability record via the CNA API with a reference tag containing a crafted payload such as the one demonstrated in the fix's test suite: an img element with an onerror handler. The record is stored and the payload is rendered unsanitized on the public /cve/<id> page accessible to all visitors. … |
| Remediation | The upstream fix is available as commit d29901655c50cf3c25737d9ea86180268df51b57 in the vulnerability-lookup/vulnerability-lookup GitHub repository; operators running self-hosted instances should update to a version containing this commit as the primary remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Vulnerability Lookup
View allToken replay in Vulnerability-Lookup's account activation and password-recovery mechanism allows an attacker who capture
SSRF guard bypass in Vulnerability Lookup's webhook notification subsystem allows a network attacker to register a webho
Inconsistent authorization enforcement in Vulnerability-Lookup's SSE streaming interface allows self-registered but unco
Server-side request forgery in Vulnerability-Lookup's remote-instance synchronization feature enables an authenticated a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today