The vulnerability arises from the CSS sanitizer in maalfer Pentestify's report theme performing validation before canonicalization, violating secure processing order (CWE-180). This allows an authenticated attacker to use CSS hex escapes to evade the sanitizer's blocklist and reconstruct the url() function. Consequently, the attacker can cause other users' browsers to make outbound HTTP requests, leaking their IP address and User-Agent headers. The issue affects versions 1.2.0 through 2.3.2 of Pentestify.

An authenticated attacker can exploit this vulnerability to force other users' browsers to send outbound HTTP requests, thereby disclosing sensitive client information such as IP addresses and User-Agent strings. This can lead to privacy breaches and potentially aid in further targeted attacks. The CVSS 4.0 base score is 5.1, indicating a medium severity impact.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit authenticated user privileges to reduce risk and monitor for suspicious activity related to CSS payloads. Avoid relying solely on the current CSS sanitizer for untrusted input.