CVE-2026-33387: CWE-1336 Improper neutralization of special elements used in a template engine in Nozomi Networks Guardian

This vulnerability (CVE-2026-33387) in Nozomi Networks Guardian involves improper neutralization of special elements used in the template engine within the Dashboards feature. An authenticated user with sufficient privileges can embed malicious payloads in dashboards, or victims can be tricked into importing malicious dashboards. Execution of these payloads occurs in the browser context of the victim, which can lead to unauthorized modification of application data or disruption of the application's availability. The issue stems from insufficient input validation of parameters used in dashboard templates. No exploits are known in the wild, and the affected versions are all versions prior to 26.3.0.

Successful exploitation allows an attacker with authenticated access and privileges to inject malicious templates into dashboards. When viewed or imported by victims, these payloads execute in the victim's browser context, enabling potential modification of application data or disruption of application availability. The attack requires user interaction (viewing or importing the malicious dashboard) and privileges to create or import dashboards.

No official patch or fix information is provided in the vendor advisory. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict dashboard creation and import privileges to trusted users only and educate users to avoid importing dashboards from untrusted sources.