CVE-2026-40028: Hayabusa HTML Report XSS Vulnerability

CVE-2026-40028 Overview

CVE-2026-40028 is a Cross-Site Scripting (XSS) vulnerability affecting Hayabusa versions prior to 3.8.0. The vulnerability exists in the HTML report output functionality, allowing an attacker to execute arbitrary JavaScript when a forensic examiner scans JSON-exported logs containing malicious content in the Computer field. This represents a supply-chain style attack targeting security professionals during log analysis workflows.

Critical Impact

An attacker can inject JavaScript into the Computer field of JSON logs that executes in the forensic examiner's browser session when viewing the generated HTML report, potentially leading to information disclosure or code execution within the analyst's environment.

Affected Products

• Hayabusa versions prior to 3.8.0
• HTML report generation functionality
• JSON log import and analysis features

Discovery Timeline

• 2026-04-08 - CVE CVE-2026-40028 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-40028

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The flaw exists in how Hayabusa processes and renders user-controllable data from imported JSON logs when generating HTML reports.

When Hayabusa processes JSON-formatted Windows event logs for analysis, certain fields such as the Computer field are incorporated directly into the generated HTML report without adequate sanitization or encoding. An attacker who can influence the contents of these JSON log files can embed malicious JavaScript payloads that will execute when the HTML report is opened in a web browser.

This attack vector is particularly concerning because it targets forensic examiners and security analysts who routinely analyze logs from potentially compromised systems. The malicious payload would execute within the context of the analyst's browser session, potentially exposing sensitive information from other open tabs, local storage data, or enabling further attacks against the analyst's workstation.

Root Cause

The root cause of this vulnerability is insufficient output encoding in the HTML report generation functionality. When the Computer field from JSON logs is rendered into the HTML output, the application fails to properly escape or encode special HTML characters such as <, >, ", and '. This allows an attacker to break out of the expected HTML context and inject arbitrary script tags or event handlers.

Attack Vector

The attack requires an adversary to craft malicious JSON log entries containing JavaScript payloads in the Computer field. When a forensic analyst imports these logs into Hayabusa and generates an HTML report, the malicious script executes in the analyst's browser. This could occur in scenarios where:

• An attacker plants malicious logs on a compromised system before forensic collection
• Log files are intercepted and modified in transit
• An insider threat manipulates exported logs before analysis

The vulnerability requires user interaction (opening the generated HTML report) and low privileges to exploit, but targets a specific high-value user group—security analysts and forensic investigators.

Detection Methods for CVE-2026-40028

Indicators of Compromise

• Unusual JavaScript patterns within the Computer field of JSON log files
• HTML report files containing unexpected <script> tags or event handler attributes
• Anomalous network connections initiated from browser processes during log report viewing

Detection Strategies

• Implement content security policies (CSP) in browsers used for forensic analysis to restrict script execution
• Scan imported JSON log files for HTML/JavaScript patterns in unexpected fields before processing
• Monitor for anomalous outbound connections during forensic analysis sessions

Monitoring Recommendations

• Enable browser developer tools to inspect HTML reports before rendering JavaScript
• Use isolated browser environments or sandboxed viewers for opening generated reports
• Review Hayabusa-generated HTML files in text mode before browser rendering

How to Mitigate CVE-2026-40028

Immediate Actions Required

• Upgrade Hayabusa to version 3.8.0 or later immediately
• Review any HTML reports generated with prior versions for suspicious content
• Consider re-analyzing logs with the patched version to generate clean reports

Patch Information

Yamato Security has released version 3.8.0 which addresses this vulnerability. The fix implements proper output encoding for user-controllable fields when generating HTML reports. Users should upgrade by downloading the latest release from the GitHub Release v3.8.0 page. Additional technical details are available in the VulnCheck Advisory.

Workarounds

• Use CSV or JSON output formats instead of HTML reports until patching is possible
• Open HTML reports in browsers with JavaScript disabled
• Process untrusted logs in isolated virtual environments
• Implement network isolation for forensic analysis workstations

# Configuration example
# Generate JSON output instead of HTML to avoid XSS risk
hayabusa json-timeline -d ./logs -o timeline.json

# Or use CSV output format as a safer alternative
hayabusa csv-timeline -d ./logs -o timeline.csv