CVE-2024-39926

An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A stored cross-site scripting (XSS) or, due to the default CSP, HTML injection vulnerability has been discovered in the admin dashboard. This potentially allows an authenticated attacker to inject malicious code into the dashboard, which is then executed or rendered in the context of an administrator's browser when viewing the injected content. However, it is important to note that the default Content Security Policy (CSP) of the application blocks most exploitation paths, significantly mitigating the potential impact.

• CWE-79

• https://github.com/dani-garcia/vaultwarden/blob/1.30.3/src/static/scripts/admin_users.js#L201Product
• https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.0Release Notes
• https://www.mgm-sp.com/cve/html-injection-in-vaultwardenExploit, Third Party Advisory

Published

Sep 13, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39920The TCP protocol in RFC 9293 has a timing side channel that …4.3
• CVE-2024-39921Observable timing discrepancy issue exists in IPCOM EX2 Seri…7.5
• CVE-2024-39922A vulnerability has been identified in LOGO! 12/24RCE (6ED10…5.1
• CVE-2024-39923An issue was discovered in Mahara 24.04 before 24.04.2 and 2…6.1
• CVE-2024-39924An issue was discovered in Vaultwarden (formerly Bitwarden_R…8.8
• CVE-2024-39925An issue was discovered in Vaultwarden (formerly Bitwarden_R…6.5
• CVE-2024-39927Out-of-bounds write vulnerability exists in Ricoh MFPs and p…8.2
• CVE-2024-39928In Apache Linkis <= 1.5.0, a Random string security vulnerab…7.5
• CVE-2024-39929Exim through 4.97.1 misparses a multiline RFC 2231 header fi…5.4
• CVE-2024-3993The AZAN Plugin WordPress plugin through 0.6 does not have C…4.6
• CVE-2024-39930The built-in SSH server of Gogs through 0.13.0 allows argume…9.9
• CVE-2024-39931Gogs through 0.13.0 allows deletion of internal files.9.9