CVE-2026-75531

Received Received - Intake

Stored XSS in Pandora URL Observables Handling

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: CIRCL

Description

Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to HTML escaping by the template engine, it was embedded inside a JavaScript string within an HTML attribute. An attacker-controlled URL containing specially crafted characters could therefore break out of the JavaScript string and inject arbitrary JavaScript code. The malicious script would execute in the context of the Pandora web application when a victim interacts with the affected Submit to Lookyloo control. Successful exploitation could allow an attacker to access information available to the victim's browser or perform actions using the victim's authenticated Pandora session. The patch removes the observable value from the inline JavaScript handler. The URL is instead stored in an HTML data-url attribute and retrieved through the DOM dataset API when needed. Additional uses of innerHTML were also replaced with textContent as defensive hardening.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-75531

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Pandora has a stored cross-site scripting (XSS) vulnerability where URL observables are rendered unsafely. A URL from an analyzed file is inserted into a JavaScript onclick handler without proper sanitization, allowing an attacker to inject malicious JavaScript code that executes in the victim's browser when they interact with the Submit to Lookyloo control.

Detection Guidance

This vulnerability involves stored XSS in Pandora's URL observables rendering. Detection requires checking Pandora's web application for improperly escaped URLs in the Submit to Lookyloo action. Inspect network traffic for URLs containing JavaScript code or special characters in onclick handlers. Review Pandora's JavaScript files for inline event handlers using URL values.

Impact Analysis

An attacker could steal sensitive information from your browser, perform actions on your behalf within Pandora using your authenticated session, or execute arbitrary code in your context. This could lead to data theft, unauthorized actions, or further compromise of your account or system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, non-compliance with privacy regulations, and potential legal or financial penalties for affected organizations.

Mitigation Strategies

Apply the official patch that removes observable values from inline JavaScript handlers. Replace innerHTML with textContent for safer DOM manipulation. Ensure all user-controlled data is properly escaped before rendering in HTML attributes or JavaScript contexts.

Hi! I’m here to help you understand CVE-2026-75531. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70