CVE-2026-26927
Unauthorized URL Manipulation in Szafir SDK Web Enables Arbitrary Execution
Publication date: 2026-04-02
Last updated on: 2026-04-02
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| szafir | szafir_sdk_web | 0.0.17.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-348 | The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Szafir SDK Web browser plug-in, which can run the SzafirHost application. An unauthenticated attacker can exploit the ability to change the URL (HTTP Origin) of the application call location by crafting a malicious website. This website can launch the SzafirHost application with arbitrary arguments via the browser add-on without validating whether the specified URL in the 'document_base_url' parameter is related to the calling web application's actual address.
When the victim confirms the execution prompt showing the attacker's URL, the application runs in the context of the attacker's website and may download additional files and libraries from that malicious source. If the victim previously selected the 'remember' option on the prompt, future executions will occur without any user interaction, allowing the attacker to run the application silently.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized execution of the SzafirHost application with attacker-controlled parameters and sources. It allows an attacker to trick users into running the application in the context of a malicious website, potentially causing the application to download and execute harmful files or libraries.
If the user previously allowed the application to run without prompts, the attacker can exploit this to execute malicious code silently, increasing the risk of compromise, data theft, or further exploitation on the victim's system.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in Szafir SDK Web was fixed in version 0.0.17.4. Immediate mitigation steps include updating the Szafir SDK Web browser plug-in to version 0.0.17.4 or later.
Additionally, users should be cautious when confirming application execution prompts, especially if the URL shown in the confirmation prompt is unfamiliar or suspicious.