CVE-2026-23839: Movary Web Application XSS Vulnerability

CVE-2026-23839 Overview

Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is ?categoryUpdated=. Version 0.70.0 fixes the issue.

Critical Impact

This reflected XSS vulnerability allows attackers to execute arbitrary JavaScript in the context of authenticated users' browser sessions, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of victims.

Affected Products

• Movary versions prior to 0.70.0

Discovery Timeline

• 2026-01-19 - CVE CVE-2026-23839 published to NVD
• 2026-01-19 - Last updated in NVD database

Technical Details for CVE-2026-23839

Vulnerability Analysis

This vulnerability is classified under CWE-20 (Improper Input Validation), which occurs when the application fails to properly validate user-supplied input before using it in a security-sensitive context. In this case, the categoryUpdated URL parameter is reflected back into the page without adequate sanitization or encoding, creating a reflected Cross-Site Scripting (XSS) vulnerability.

The attack vector is network-based and requires user interaction, as victims must be tricked into clicking a malicious link containing the XSS payload. Once triggered, the attacker's JavaScript executes within the victim's authenticated session context, with full access to the DOM and any stored session tokens or cookies that are not protected with the HttpOnly flag.

This vulnerability can be exploited to perform account takeover, steal sensitive user data including movie watch history and personal preferences, modify user settings, or redirect users to malicious sites. The scope is changed (S:C), meaning the vulnerable component impacts resources beyond its security scope.

Root Cause

The root cause is insufficient input validation and output encoding on the categoryUpdated query parameter. The vulnerable code in settings-account-location.js directly uses the parameter value without sanitizing special characters that could break out of the HTML context and inject executable script content. This is a common oversight in web applications where URL parameters are reflected into page content for status messaging or user feedback purposes.

Attack Vector

The attack requires an attacker to craft a malicious URL containing JavaScript payload in the categoryUpdated parameter. When a victim clicks this link while authenticated to the Movary application, the payload executes in their browser session. The attacker can distribute the malicious URL via phishing emails, social media, or embedding it in other websites.

The vulnerability is exploited by injecting JavaScript code into the vulnerable parameter. For example, an attacker could craft a URL that includes script tags or event handlers that execute when the page renders. Technical details and the specific vulnerable code path can be found in the GitHub Security Advisory and the vulnerable code location.

Detection Methods for CVE-2026-23839

Indicators of Compromise

• Unusual URL parameters containing encoded JavaScript or HTML tags in access logs, particularly targeting the categoryUpdated parameter
• Log entries showing requests with suspicious characters such as <script>, onerror=, onload=, or URL-encoded equivalents in query strings
• Reports from users about unexpected behavior or redirects when using settings pages

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS patterns in the categoryUpdated parameter
• Deploy Content Security Policy (CSP) headers that restrict inline script execution and report violations
• Monitor server access logs for URL patterns containing common XSS payloads or encoded script content
• Use browser-based security tools and extensions that can detect reflected XSS attempts

Monitoring Recommendations

• Enable detailed logging of all query parameters for settings-related endpoints
• Configure alerting for CSP violation reports that may indicate XSS exploitation attempts
• Regularly review access logs for anomalous request patterns targeting vulnerable parameters

How to Mitigate CVE-2026-23839

Immediate Actions Required

• Upgrade Movary to version 0.70.0 or later immediately
• If immediate upgrade is not possible, implement WAF rules to filter malicious input in the categoryUpdated parameter
• Review user accounts for any signs of unauthorized access or session hijacking
• Educate users about the risks of clicking unknown links

Patch Information

The vulnerability has been fixed in Movary version 0.70.0. Users should upgrade to this version or later to remediate the vulnerability. The fix can be obtained from the GitHub Release 0.70.0. For detailed information about the vulnerability and the fix, refer to the GitHub Security Advisory GHSA-v32w-5qx7-p3vq.

Workarounds

• Implement Content Security Policy headers with script-src 'self' to prevent inline script execution
• Deploy a reverse proxy or WAF with XSS filtering capabilities in front of the Movary application
• Restrict access to the application to trusted networks until the patch can be applied
• Consider temporarily disabling or restricting access to the affected settings functionality if patch deployment is delayed

# Example Content Security Policy header configuration for Apache
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none';"