CVE-2026-49864

Received Received - Intake

Stored XSS in Wetty Terminal Access Tool

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (`escapeMarkup: false`). Any output the victim renders - a `cat`'d file, a tailed log, an SSH MOTD, a `curl` response - that contains `\x1b[5i...:...\x1b[4i` runs script in the wetty origin and types attacker-chosen keystrokes into the victim's SSH session. Version 3.0.4 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-49864

EUVD

EUVD-2026-58245

Affected Vendors & Products

Vendor	Product	Version / Range
wetty	wetty	to 3.0.4 (inc)
butlerx	wetty	to 3.0.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-49864 is a DOM-based Cross-Site Scripting (XSS) vulnerability in wetty terminal emulator versions before 3.0.4. Attackers exploit it by sending a base64-encoded filename in a file-download escape sequence. The application decodes this filename and inserts it raw into a Toastify HTML notification without proper escaping. When a victim views terminal output containing this sequence, the payload executes JavaScript in the wetty origin.

Detection Guidance

Check the version of wetty installed on your system. If it is before 3.0.4, the system is vulnerable. Run: npm list wetty or check the package version in your application files.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the wetty origin. They can type attacker-chosen keystrokes into the victim's SSH session, leading to full command execution as the wetty user. This compromises confidentiality by reading terminal contents, integrity by injecting commands, and may escalate privileges on shared SSH hosts.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating GDPR's confidentiality requirements and HIPAA's security rules for protected health information. It may result in data breaches, unauthorized command execution, and potential privilege escalation, all of which are compliance violations.

Mitigation Strategies

Upgrade wetty to version 3.0.4 or later immediately. If upgrading is not possible, apply the patch from the GitHub advisory to escape markup in Toastify notifications. Disable file download escape sequences if not required.

Hi! I’m here to help you understand CVE-2026-49864. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70