Recon ng: Mistune Image Directive CSS Injection Vulnerability (CVE-2026-44899)

The Image directive plugin in recon-ng uses a regex that only matches the start of the :width: and :height: option values, allowing any string beginning with digits to pass validation. When the width or height is not a plain integer, the value is inserted directly into the style attribute without escaping. This allows injection of arbitrary CSS properties, such as position:fixed and background-color, enabling an attacker to overlay malicious content visually over the entire browser viewport. The vulnerability is identified as CVE-2026-44899 and affects recon-ng versions >=5.1.1_1 and <5.1.2_4.

An attacker can inject arbitrary CSS into the style attribute of images rendered by the vulnerable plugin, enabling full-page overlays that can be used for phishing or UI redressing attacks. This can deceive users by visually covering legitimate content with attacker-controlled elements. The CVSS score is 4.7 (medium severity), indicating limited confidentiality impact but significant potential for user interface manipulation.

A patch is available for recon-ng that fixes this vulnerability. Users should upgrade to version 5.1.2_4 or later to remediate the issue. Until patched, avoid using untrusted input in the :width: and :height: options of the Image directive plugin or apply input validation to ensure only safe values are accepted.