CVE-2026-75531

Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to HTML escaping by the template engine, it was embedded inside a JavaScript string within an HTML attribute. An attacker-controlled URL containing specially crafted characters could therefore break out of the JavaScript string and inject arbitrary JavaScript code. The malicious script would execute in the context of the Pandora web application when a victim interacts with the affected Submit to Lookyloo control. Successful exploitation could allow an attacker to access information available to the victim's browser or perform actions using the victim's authenticated Pandora session. The patch removes the observable value from the inline JavaScript handler. The URL is instead stored in an HTML data-url attribute and retrieved through the DOM dataset API when needed. Additional uses of innerHTML were also replaced with textContent as defensive hardening.

• CWE-79

• https://github.com/pandora-analysis/pandora/commit/77a84a039e2079dba7ea0342816c9813099d75d0

Published

Aug 17, 2026

Last Modified

Aug 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75514BunkerWeb is an open-source, next-generation Web Application…5.9
• CVE-2026-7552The Geo Mashup plugin for WordPress is vulnerable to authori…5.3
• CVE-2026-75526django CMS is an easy-to-use and developer-friendly enterpri…4.4
• CVE-2026-75528The Broken Link Checker plugin for WordPress is vulnerable t…7.2
• CVE-2026-75529Pandora is affected by a stored cross-site scripting vulnera…6.9
• CVE-2026-7553A vulnerability was found in code-projects Gym Management Sy…4.7
• CVE-2026-75538An attacker that connects to an open Erlang TCP port that us…8.2
• CVE-2026-7554A vulnerability was determined in D-Link M60 up to 1.20B02. …8.1
• CVE-2026-75542Incorrect Authorization vulnerability in the OAuth token end…8.3
• CVE-2026-75548The affected Ebyte device web management interface does not …5.4
• CVE-2026-7555A vulnerability was identified in itsourcecode Electronic Ju…7.3
• CVE-2026-75554Insufficient Session Expiration vulnerability in the OAuth t…2.3