CVE-2026-75531 - Stored Cross-Site Scripting Vulnerability in Pandora

CVE-2026-75531 - Stored Cross-Site Scripting Vulnerability in Pandora

CVE-2026-75531, a stored cross-site scripting (XSS) vulnerability, has been identified in Pandora. This vulnerability impacts the rendering of URL observables. The new CVE was received on August 17, 2026. The vulnerability affects Pandora versions 0 up to and including 1.12.5.

According to the vulnerability description, a URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to HTML escaping by the template engine, it was embedded inside a JavaScript string within an HTML attribute. This allowed an attacker-controlled URL containing specially crafted characters to break out of the JavaScript string and inject arbitrary JavaScript code. The malicious script would execute in the context of the Pandora web application when a victim interacts with the affected Submit to Lookyloo control. Successful exploitation could allow an attacker to access information available to the victim’s browser or perform actions using the victim’s authenticated Pandora session.

The patch removes the observable value from the inline JavaScript handler. The URL is instead stored in an HTML data-url attribute and retrieved through the DOM dataset API when needed. Additionally, uses of innerHTML were replaced with textContent as defensive hardening measures.

The vulnerability is categorized under CWE-79. A reference to the fix and further details can be found in the commit: GitHub Commit.

To read the complete article see: Read full article 🚀