CVE-2026-40028: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Yamato-Security hayabusa
Hayabusa versions prior to 3.8.0 contain a cross-site scripting (XSS) vulnerability in its HTML report output that allows an attacker to execute arbitrary JavaScript when a user scans JSON-exported logs containing malicious content in the Computer field. An attacker can inject JavaScript into the Computer field of JSON logs that executes in the forensic examiner's browser session when viewing the generated HTML report, leading to information disclosure or code execution.
AI Analysis
Technical Summary
CVE-2026-40028 is a cross-site scripting vulnerability in Yamato-Security's hayabusa product affecting versions prior to 3.8.0. The issue arises from improper neutralization of input in the Computer field of JSON-exported logs, which are rendered in the HTML report output. Malicious JavaScript injected into this field executes in the browser of anyone viewing the report, potentially exposing sensitive information or enabling code execution. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity). No patch or official remediation level has been published, and hayabusa is not a cloud service, so remediation depends on vendor or user action.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the forensic examiner's browser session when viewing the HTML report. This can lead to information disclosure or code execution within the user's browser environment. The impact is limited to users who open maliciously crafted JSON-exported logs in hayabusa's report viewer. There are no known active exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should avoid opening JSON-exported logs from untrusted sources in hayabusa versions prior to 3.8.0. Monitor vendor communications for updates regarding patches or mitigations.
CVE-2026-40028: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Yamato-Security hayabusa
Description
Hayabusa versions prior to 3.8.0 contain a cross-site scripting (XSS) vulnerability in its HTML report output that allows an attacker to execute arbitrary JavaScript when a user scans JSON-exported logs containing malicious content in the Computer field. An attacker can inject JavaScript into the Computer field of JSON logs that executes in the forensic examiner's browser session when viewing the generated HTML report, leading to information disclosure or code execution.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-40028 is a cross-site scripting vulnerability in Yamato-Security's hayabusa product affecting versions prior to 3.8.0. The issue arises from improper neutralization of input in the Computer field of JSON-exported logs, which are rendered in the HTML report output. Malicious JavaScript injected into this field executes in the browser of anyone viewing the report, potentially exposing sensitive information or enabling code execution. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity). No patch or official remediation level has been published, and hayabusa is not a cloud service, so remediation depends on vendor or user action.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the forensic examiner's browser session when viewing the HTML report. This can lead to information disclosure or code execution within the user's browser environment. The impact is limited to users who open maliciously crafted JSON-exported logs in hayabusa's report viewer. There are no known active exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should avoid opening JSON-exported logs from untrusted sources in hayabusa versions prior to 3.8.0. Monitor vendor communications for updates regarding patches or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-04-08T13:36:47.863Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d6cdb91cc7ad14dab5bf98
Added to database: 4/8/2026, 9:50:49 PM
Last enriched: 4/8/2026, 10:06:28 PM
Last updated: 4/9/2026, 7:18:11 AM
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.