CVE-2026-79720

Analyzed Analyzed - Analysis Complete

Reflected XSS in Netron Desktop Application

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: HiddenLayer

Description

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-79720

EUVD

EUVD-2026-67092

Affected Vendors & Products

Vendor	Product	Version / Range
lutzroeder	netron	to 9.1.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in Netron versions 9.1.2 or earlier. It occurs in the desktop application due to unsanitized node names, allowing attackers to inject malicious scripts. These scripts can hide certain nodes, perform port scanning, or exploit a Chrome n-day to achieve Remote Code Execution.

Detection Guidance

Check Netron version with 'npm list -g netron' or 'netron --version'. If <=9.1.2, the system is vulnerable. Inspect model files for unsanitized HTML strings in node names or descriptions that could trigger XSS.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your system, steal sensitive data, or perform actions on your behalf. It may also allow unauthorized access to your network through port scanning or other malicious activities.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update Netron to the latest version (>=9.1.3) to patch the reflected XSS vulnerability in node names. Avoid using untrusted input for node names and sanitize all user-provided data.

Hi! I’m here to help you understand CVE-2026-79720. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70