CVE-2026-19744
Received Received - Intake

Cross-Site Scripting in Pentestify Markdown Renderer

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: 4daa8cea-433a-44bd-9456-53b127fc289a

Description
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotes

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-19744
EUVD
EUVD-2026-58109

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
maalfer pentestify to 2.3.2 (exc)
ccyl13 pentestify 2.3.2
ccyl13 pentestify to 2.3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-site Scripting (XSS) vulnerability in Pentestify, a penetration testing tool. It affects versions before 2.3.2. The flaw allows authenticated users to inject malicious JavaScript via Markdown links in report fields. The markdownToHtml function fails to escape double quotes in URLs, enabling attackers to close the href attribute and inject event handlers like onmouseover. This executes arbitrary JavaScript when other users view reports.

Detection Guidance

Check if your Pentestify instance is running a vulnerable version (before 2.3.2) by inspecting the application version or changelog. Review report fields like finding descriptions, impact reports, or audit summaries for Markdown links with suspicious URLs containing quotes or event handlers (e.g., onmouseover). Use browser developer tools to inspect rendered HTML for improperly escaped quotes in anchor tags.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or deface the application. Since the session cookie is HttpOnly, direct theft is limited, but scripts can still execute in the user's browser when viewing reports. This could lead to data theft, unauthorized actions, or malware distribution through the application.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face fines for non-compliance if user data is exposed due to this flaw. The risk of unauthorized access or data leakage poses significant compliance risks.

Mitigation Strategies

Upgrade Pentestify to version 2.3.2 or later immediately. If upgrading is not possible, review and sanitize all user-provided Markdown input manually, ensuring quotes in URLs are escaped. Disable or restrict access to report generation features until patched. Monitor for unusual script execution in user browsers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19744. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart