CVE-2026-33387

Awaiting Analysis Awaiting Analysis - Queue

Template Injection in Nozomi Networks Dashboards

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Nozomi Networks Inc.

Description

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard. When the victim views or imports the dashboard, the payload executes in their browser context, allowing the attacker to modify application data or disrupt application availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-09

AI Q&A

2026-09-09

EPSS Evaluated

N/A

NVD

CVE-2026-33387

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

This is a template injection vulnerability in the Dashboards functionality caused by improper input validation. An authenticated user with privileges can create a dashboard with a malicious payload or trick a victim into importing one. When viewed or imported, the payload executes in the victim's browser, allowing data modification or application disruption.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized dashboard imports or suspicious payloads in dashboard configurations. Review dashboard JSON files for unexpected JavaScript or HTML content. Monitor browser console logs for execution errors when viewing dashboards.

Impact Analysis

An attacker could modify application data or disrupt service availability. If you view or import a malicious dashboard, your browser executes the payload, potentially leading to unauthorized changes or downtime.

Mitigation Strategies

Immediately restrict dashboard import permissions to trusted users only. Update the application to validate all dashboard input parameters strictly. Remove any untrusted dashboards and audit existing ones for malicious payloads. Consider disabling dynamic dashboard features temporarily.

Hi! I’m here to help you understand CVE-2026-33387. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70