CVE-2026-40028
Cross-Site Scripting in Hayabusa HTML Report Enables Code Execution
Publication date: 2026-04-08
Last updated on: 2026-04-17
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yamato-security | hayabusa | to 3.8.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
Hayabusa versions prior to 3.8.0 have a cross-site scripting (XSS) vulnerability in their HTML report output. This vulnerability allows an attacker to inject malicious JavaScript code into the Computer field of JSON-exported logs. When a forensic examiner views the generated HTML report, the injected JavaScript executes in their browser session.
How can this vulnerability impact me? :
This vulnerability can lead to information disclosure or code execution within the forensic examiner's browser session. An attacker exploiting this flaw can execute arbitrary JavaScript, potentially stealing sensitive information or performing unauthorized actions on behalf of the user viewing the report.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Hayabusa to version 3.8.0 or later, as versions prior to 3.8.0 contain the cross-site scripting (XSS) vulnerability.
Avoid scanning or generating HTML reports from JSON-exported logs that may contain malicious content in the Computer field until the upgrade is applied.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker to execute arbitrary JavaScript in the forensic examiner's browser session, potentially leading to information disclosure or code execution. Such unauthorized disclosure or compromise of sensitive information could negatively impact compliance with data protection regulations like GDPR or HIPAA, which require safeguarding personal and sensitive data against unauthorized access or breaches.