CVE-2026-40028 is a cross-site scripting (XSS) vulnerability in Yamato-Security's hayabusa product versions prior to 3.8.0. The issue arises from improper neutralization of input in the Computer field of JSON-exported logs, which are then rendered in HTML reports. An attacker can craft malicious JavaScript payloads within this field that execute when the report is viewed, potentially exposing sensitive information or enabling code execution in the user's browser. The vulnerability has a CVSS 4.0 score of 5.1, reflecting medium severity. No official fix or patch has been documented, and the product is not cloud-hosted, so users must await vendor updates or apply manual mitigations.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the forensic examiner's browser session when viewing HTML reports generated by hayabusa. This can lead to information disclosure or unauthorized code execution. The vulnerability affects all versions prior to 3.8.0. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should avoid opening HTML reports generated from untrusted or suspicious JSON-exported logs containing potentially malicious Computer field data. Monitor vendor communications for updates regarding patches or official mitigations.