CVE-2026-75531 is a stored cross-site scripting (XSS) vulnerability in pandora-analysis pandora affecting versions up to 1.12.5. The flaw occurs because URLs extracted from analyzed files are inserted directly into inline JavaScript onclick handlers used by the Submit to Lookyloo action. Although HTML escaping was applied, the URL was embedded inside a JavaScript string within an HTML attribute, enabling an attacker to break out of the string and inject arbitrary JavaScript code. This malicious script executes in the victim's browser context when interacting with the affected control, potentially exposing information or allowing actions under the victim's authenticated session. The patch removes the observable URL from inline JavaScript and instead stores it in an HTML data-url attribute accessed via the DOM dataset API, also replacing innerHTML usage with textContent to harden defenses.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the Pandora web application within the victim's browser. This can lead to theft of sensitive information accessible to the victim or unauthorized actions performed with the victim's authenticated session privileges. The vulnerability requires user interaction (UI) but does not require privileges or authentication to exploit. The CVSS 4.0 score is 7 (high severity), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and high impact on integrity and availability.

A patch is available that removes the vulnerable inline JavaScript handler and replaces it with a safer mechanism using HTML data attributes and DOM APIs. Users should upgrade pandora to versions later than 1.12.5 where this fix is applied. No additional mitigations are indicated as the patch fully addresses the vulnerability.