CVE-2026-40028
Last modified
CVE-2026-40028 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Hayabusa versions prior to 3.8.0 contain a cross-site scripting (XSS) vulnerability in its HTML report output that allows an attacker to execute arbitrary JavaScript when a user scans JSON-exported logs containing malicious content in the Computer field. An attacker can inject JavaScript into the Computer field of JSON logs that executes in the forensic examiner's browser session when viewing the generated HTML report, leading to information disclosure or code execution.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
Hayabusa versions prior to 3.8.0 contain a cross-site scripting (XSS) vulnerability in its HTML report output that allows an attacker to execute arbitrary JavaScript when a user scans JSON-exported logs containing malicious content in the Computer field. An attacker can inject JavaScript into the Computer field of JSON logs that executes in the forensic examiner's browser session when viewing the generated HTML report, leading to information disclosure or code execution.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Yamato-Security | Hayabusa | < 3.8.0 |
References
- https://mobasi.ai/sentinelThird Party Advisory
- https://www.vulncheck.com/advisories/hayabusa-xss-via-json-log-importThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-40028?
How severe is CVE-2026-40028?
How do I fix CVE-2026-40028?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-40022When authentication is enabled on the Apache Camel embedded …8.2
- CVE-2026-40023Apache Log4cxx's XMLLayout https://logging.apache.org/log4c…5.3
- CVE-2026-40024The Sleuth Kit through 4.14.0 contains a path traversal vuln…7.1
- CVE-2026-40025The Sleuth Kit through 4.14.0 contains an out-of-bounds read…6.1
- CVE-2026-40026The Sleuth Kit through 4.14.0 contains an out-of-bounds read…7.1
- CVE-2026-40027ALEAPP (Android Logs Events And Protobuf Parser) through 3.4…8.4
- CVE-2026-40029parseusbs before 1.9 contains an OS command injection vulner…7.8
- CVE-2026-4003The Users manager – PN plugin for WordPress is vulnerable to…9.8
- CVE-2026-40030parseusbs before 1.9 contains an OS command injection vulner…8.4
- CVE-2026-40031MemProcFS before 5.17 contains multiple unsafe library-loadi…8.5
- CVE-2026-40032UAC (Unix-like Artifacts Collector) before 3.3.0-rc1 contain…8.5
- CVE-2026-40033FreeRDP before 3.26.0 contains a heap-buffer-overflow vulner…8.8
Are you affected by CVE-2026-40028?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST