CVE-2026-19744: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in maalfer Pentestify
CVE-2026-19744 is a medium severity cross-site scripting (XSS) vulnerability in the Markdown renderer of maalfer Pentestify before version 2.3.2. Authenticated users can exploit this flaw by crafting a Markdown link with a URL containing a double quote, which breaks the href attribute and allows arbitrary JavaScript execution within the application origin. This occurs because the renderer's sanitization does not properly escape quotes in URLs.
AI Analysis
Technical Summary
This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the Markdown renderer component of maalfer Pentestify versions prior to 2.3.2. The flaw allows authenticated users to inject JavaScript by including a double quote in a Markdown link URL, which prematurely closes the href attribute in the generated anchor tag. The renderer fails to escape these quotes during sanitization, enabling cross-site scripting attacks within the application's origin context.
Potential Impact
An attacker with authenticated access can execute arbitrary JavaScript in the context of the affected application, potentially leading to session hijacking, unauthorized actions, or data exposure within the user's session. The vulnerability requires user interaction (UI:P) and low privileges (PR:L), limiting its impact to authenticated users but still posing a risk to application integrity and user data.
Mitigation Recommendations
No official fix or patch is currently confirmed for this vulnerability. Users should monitor the vendor's advisories for updates. In the meantime, restricting Markdown input or applying additional sanitization on URLs containing quotes may reduce risk. Avoid using affected versions prior to 2.3.2 once a patch is released.
CVE-2026-19744: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in maalfer Pentestify
Description
CVE-2026-19744 is a medium severity cross-site scripting (XSS) vulnerability in the Markdown renderer of maalfer Pentestify before version 2.3.2. Authenticated users can exploit this flaw by crafting a Markdown link with a URL containing a double quote, which breaks the href attribute and allows arbitrary JavaScript execution within the application origin. This occurs because the renderer's sanitization does not properly escape quotes in URLs.
CVSS v4.0
Score 5.1medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the Markdown renderer component of maalfer Pentestify versions prior to 2.3.2. The flaw allows authenticated users to inject JavaScript by including a double quote in a Markdown link URL, which prematurely closes the href attribute in the generated anchor tag. The renderer fails to escape these quotes during sanitization, enabling cross-site scripting attacks within the application's origin context.
Potential Impact
An attacker with authenticated access can execute arbitrary JavaScript in the context of the affected application, potentially leading to session hijacking, unauthorized actions, or data exposure within the user's session. The vulnerability requires user interaction (UI:P) and low privileges (PR:L), limiting its impact to authenticated users but still posing a risk to application integrity and user data.
Mitigation Recommendations
No official fix or patch is currently confirmed for this vulnerability. Users should monitor the vendor's advisories for updates. In the meantime, restricting Markdown input or applying additional sanitization on URLs containing quotes may reduce risk. Avoid using affected versions prior to 2.3.2 once a patch is released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Secur0
- Date Reserved
- 2026-08-13T14:08:42.626Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7de96abf8831d5396b0494
Added to database: 08/13/2026, 15:57:30 UTC
Last enriched: 08/13/2026, 16:14:32 UTC
Last updated: 08/13/2026, 16:23:04 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.