CVE-2026-22191 is a template injection vulnerability in Beghelli Sicuro24 SicuroWeb affecting AngularJS 1.5.2. It arises from improper neutralization of special elements used in the template engine, allowing attackers to inject arbitrary AngularJS expressions. These expressions are compiled and executed by the AngularJS runtime in the context of operator browser sessions, enabling arbitrary JavaScript execution. The attack vector includes network-adjacent attackers performing man-in-the-middle injection on unencrypted HTTP traffic. The CVSS 4.0 vector indicates low attack complexity, no privileges required, user interaction needed, and limited scope impact.

Successful exploitation enables arbitrary JavaScript execution in the context of operator browsers using SicuroWeb, potentially leading to session hijacking or unauthorized actions within the application. Network-adjacent attackers can exploit this vulnerability if they can intercept and modify plaintext HTTP traffic. There is no indication of privilege escalation or impact beyond the operator's browser session. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is documented, users should avoid deploying SicuroWeb over unencrypted HTTP to prevent man-in-the-middle injection attacks. Consider implementing network-level protections such as enforcing HTTPS and using secure transport to mitigate exploitation risk until an official fix is available.