CVE-2026-75531
Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora
Description
Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to HTML escaping by the template engine, it was embedded inside a JavaScript string within an HTML attribute. An attacker-controlled URL containing specially crafted characters could therefore break out of the JavaScript string and inject arbitrary JavaScript code. The malicious script would execute in the context of the Pandora web application when a victim interacts with the affected Submit to Lookyloo control. Successful exploitation could allow an attacker to access information available to the victim's browser or perform actions using the victim's authenticated Pandora session. The patch removes the observable value from the inline JavaScript handler. The URL is instead stored in an HTML data-url attribute and retrieved through the DOM dataset API when needed. Additional uses of innerHTML were also replaced with textContent as defensive hardening.
INFO
Published Date :
Aug. 17, 2026, 9:16 p.m.
Last Modified :
Oct. 23, 2026, 4:10 p.m.
Remotely Exploit :
Yes !
Source :
5a6e4751-2f3f-4070-9419-94fb35b644e8
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | 5a6e4751-2f3f-4070-9419-94fb35b644e8 | ||||
| CVSS 4.0 | HIGH | 5a6e4751-2f3f-4070-9419-94fb35b644e8 |
Solution
- Apply the security patch provided by the vendor.
- Avoid inserting untrusted data directly into JavaScript.
- Use DOM dataset API for retrieving data.
- Replace innerHTML with textContent where possible.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-75531.
| URL | Resource |
|---|---|
| https://github.com/pandora-analysis/pandora/commit/77a84a039e2079dba7ea0342816c9813099d75d0 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-75531 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-75531
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-75531 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-75531 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: pandora de pandora-analysis, Description: Pandora contiene una vulnerabilidad de cross-site scripting (XSS) almacenado en la representación de observables de URL. Una URL extraída o asociada con un archivo analizado fue insertada directamente en el gestor JavaScript onclick en línea utilizado por la acción Submit to Lookyloo. Aunque el valor estaba sujeto a escape HTML por el motor de plantillas, fue incrustado dentro de una cadena JavaScript dentro de un atributo HTML. Una URL controlada por el atacante que contiene caracteres especialmente diseñados podría, por lo tanto, salir de la cadena JavaScript e inyectar código JavaScript arbitrario. El script malicioso se ejecutaría en el contexto de la aplicación web de Pandora cuando una víctima interactúa con el control afectado Submit to Lookyloo. La explotación exitosa podría permitir a un atacante acceder a información disponible para el navegador de la víctima o realizar acciones utilizando la sesión autenticada de Pandora de la víctima. El parche elimina el valor observable del gestor JavaScript en línea. La URL se almacena en su lugar en un atributo HTML data-url y se recupera a través de la API del conjunto de datos DOM cuando es necesario. Usos adicionales de innerHTML también fueron reemplazados por textContent como endurecimiento defensivo. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 18, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-75531', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-18T15:20:15.871185Z'} -
New CVE Received by 5a6e4751-2f3f-4070-9419-94fb35b644e8
Aug. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/pandora-analysis/pandora', 'vendor': 'pandora-analysis', 'product': 'pandora', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '1.12.5'}], 'defaultStatus': 'unaffected'}] Added Description Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to HTML escaping by the template engine, it was embedded inside a JavaScript string within an HTML attribute. An attacker-controlled URL containing specially crafted characters could therefore break out of the JavaScript string and inject arbitrary JavaScript code. The malicious script would execute in the context of the Pandora web application when a victim interacts with the affected Submit to Lookyloo control. Successful exploitation could allow an attacker to access information available to the victim's browser or perform actions using the victim's authenticated Pandora session. The patch removes the observable value from the inline JavaScript handler. The URL is instead stored in an HTML data-url attribute and retrieved through the DOM dataset API when needed. Additional uses of innerHTML were also replaced with textContent as defensive hardening. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-79 Added Reference https://github.com/pandora-analysis/pandora/commit/77a84a039e2079dba7ea0342816c9813099d75d0