Stored XSS in Pen Drive Report Generator

Executive Summary

CVE-2026-13083 is a stored cross-site scripting (XSS) vulnerability in the Pen Drive tool's HTML report generation feature.

The flaw occurs because cluster-sourced data, such as ClusterVersion spec.channel, CatalogSource metadata, and Subscription configuration, is rendered into HTML reports without proper escaping or sanitization.

An attacker with cluster administrator privileges or the ability to modify a must-gather archive can inject malicious HTML and JavaScript code into these fields.

When a user opens the generated HTML report in their browser, the injected script executes in their context, potentially causing harmful effects.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the execution of malicious scripts in the browser of any user who opens the affected HTML report.

• Session token theft
• Credential exfiltration
• Manipulation of report content

These impacts arise because the attacker can inject code that runs with the privileges of the user viewing the report.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if malicious scripts have been injected into cluster objects such as ClusterVersion spec.channel. One way to detect this is by inspecting these fields for unexpected HTML or JavaScript code.

For example, you can use the following command to check the ClusterVersion spec.channel field for suspicious content:

• oc get clusterversion version -o jsonpath='{.spec.channel}'

If the output contains HTML tags or JavaScript code (e.g., <img src=x onerror=alert(1)>), it indicates a possible injection.

Additionally, reviewing must-gather archives for injected scripts in metadata fields can help detect the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading the Pen Drive tool to version 1.0.0-2 or later, where this vulnerability has been fixed.

Until the upgrade is applied, restrict cluster administrator privileges to trusted users only, as the vulnerability requires such privileges to inject malicious payloads.

Avoid opening HTML reports generated by Pen Drive from untrusted sources or clusters that may have been compromised.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker with cluster administrator privileges to inject malicious scripts into HTML reports, which execute in the browser of any user who opens the report. This can lead to session token theft, credential exfiltration, or content manipulation.

Such unauthorized access and potential data exposure could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information against unauthorized access and breaches.

Useful 0 Not Useful 0