CVE-2026-73374
Received Received - Intake

Stored XSS in Vulnerability-Lookup via Reference Tags

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references[].tags[] were directly interpolated into HTML badge elements and the resulting string was wrapped in markupsafe.Markup. Because Markup marks the generated content as safe, Jinja's automatic HTML escaping was bypassed. An authenticated user with permissions to create or modify vulnerability records, such as a user holding the vulnerability:create or vulnerability:modify permission, could submit a crafted reference tag through the CNA API containing arbitrary HTML or JavaScript-capable markup. The malicious value would subsequently be stored as part of the vulnerability record. When another user visited the corresponding public /cve/<id> or /vuln/<id> page, the crafted tag would be rendered as HTML in the viewer's browser. This could result in JavaScript execution in the security context of the Vulnerability-Lookup application. Successful exploitation could allow an attacker to perform actions in the context of a victim, access information available to the victim's browser session, or modify page content. As the affected vulnerability pages can be accessed publicly, exploitation may affect users who are not authenticated. The issue was corrected by applying markupsafe.escape() to each reference tag before inserting it into the HTML badge markup, while retaining Markup only for the static HTML scaffolding.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-73374
EUVD
EUVD-2026-57219

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Vulnerability-Lookup tool. It occurs in the render_tag_badges Jinja filter, which displays reference tags for vulnerability records. The issue is that user-controlled tag values from the CNA API are directly inserted into HTML badge elements without proper escaping. The application incorrectly marks the output as safe using markupsafe.Markup, bypassing Jinja's automatic HTML escaping. This allows attackers with permission to create or modify vulnerability records to inject malicious HTML or JavaScript into tags. When other users view the affected CVE or vulnerability pages, the crafted tags execute in their browsers.

Detection Guidance

To detect this XSS vulnerability, inspect the rendered HTML output of CVE or vulnerability pages for unexpected HTML or JavaScript tags in reference badges. Check server logs for requests containing suspicious payloads like <img src=x onerror=...> in reference tags. Review the render_tag_badges function in website/web/filters/__init__.py for improper escaping of tag values.

Impact Analysis

An attacker could exploit this to execute JavaScript in your browser when you view a vulnerable CVE or vulnerability page. This could allow them to perform actions as you, steal your session information, or modify what you see on the page. Even unauthenticated users could be affected since the vulnerable pages are public. The impact depends on what the attacker chooses to do with the injected script.

Mitigation Strategies

Apply the patch from the vulnerability-lookup repository commit d29901655c50cf3c25737d9ea86180268df51b57. Ensure all user-controlled tag values are escaped using markupsafe.escape() before rendering in HTML badges. Restrict permissions for vulnerability:create and vulnerability:modify to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73374. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart