CVE-2026-55696

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting attachmentLink's href for the Download attachment link. The SVG-only sanitization branch updates only the preview blob, so text/html, image/svg, application/xhtml+xml, and text/xml attachments can remain active in the download blob. On an instance with fileupload = true and a weakened, stripped, or absent Content Security Policy, an anonymous attacker can create such an attachment, and a victim who opens the link in a new tab causes inline JavaScript to execute in the PrivateBin origin. The script can read origin-scoped local storage and issue same-origin requests, including requests to applications co-hosted on the same domain. This issue is fixed in version 2.0.5.

• CWE-79
• CWE-80

• https://github.com/PrivateBin/PrivateBin/commit/7f1f40853efe0eb12db9cc4a30ea8524ac00f423
• https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.5
• https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-f2xf-7x3g-4272

Published

Aug 28, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5569A vulnerability was found in Technostrobe HI-LED-WR120-G2 5.…9.8
• CVE-2026-55690The EmbedVideo Extension is a MediaWiki extension which adds…7.5
• CVE-2026-55691The EmbedVideo Extension is a MediaWiki extension which adds…8.6
• CVE-2026-55692The EmbedVideo Extension is a MediaWiki extension which adds…7.5
• CVE-2026-55693Vim is an open source, command line text editor. Prior to 9.…7.8
• CVE-2026-55694Snipe-IT is an IT asset/license management system. Prior to …7.1
• CVE-2026-55697pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm…8.8
• CVE-2026-55698pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm…8.8
• CVE-2026-55699pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Mani…6.5
• CVE-2026-5570A vulnerability was determined in Technostrobe HI-LED-WR120-…9.8
• CVE-2026-55700pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm s…7.1
• CVE-2026-55701The OpenTelemetry Collector Contrib repository contains comp…6.9