Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform… (CVE-2026-79720)

Netron desktop application versions <=9.1.2 are affected by a reflected XSS vulnerability due to unsanitized node names. This vulnerability allows attackers to manipulate the application interface by hiding nodes, perform port scanning, and potentially escalate to remote code execution by abusing a Chrome n-day vulnerability. The CVSS 3.1 vector indicates local attack vector, low attack complexity, no privileges required, user interaction required, scope changed, with low confidentiality and integrity impact and no availability impact.

Successful exploitation can lead to partial confidentiality and integrity compromise within the affected application context. Attackers can hide nodes in the interface and perform port scanning. Additionally, by chaining with a Chrome n-day vulnerability, remote code execution may be achieved. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening untrusted files or node names in Netron. No vendor advisory or patch links are currently provided.