CVE-2026-59238: maalfer Pentestify XSS Vulnerability

CVE-2026-59238 Overview

CVE-2026-59238 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in maalfer Pentestify before version 1.1.0. The flaw resides in the client-side report rendering functions renderPreview, renderEditor, and renderAuditData located in js/app.js. A remote, authenticated attacker can store a malicious payload in a finding's images array or a report's client_logo array. The application interpolates these values into an <img>src attribute without escaping, allowing arbitrary JavaScript to execute in the browser of any user who views the affected report.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in the sessions of other Pentestify users viewing tampered reports, enabling session theft and report tampering.

Affected Products

maalfer Pentestify versions prior to 1.1.0
Pentestify client-side rendering module (js/app.js)
Pentestify report backend accepting images and client_logo inputs

Discovery Timeline

2026-07-20 - CVE-2026-59238 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-59238

Vulnerability Analysis

The vulnerability originates in three client-side rendering routines in js/app.js: renderPreview, renderEditor, and renderAuditData. These functions build report DOM content by concatenating attacker-controlled strings directly into an <img> tag's src attribute. Because Pentestify does not validate or escape entries stored in the finding images array or the report client_logo array, a crafted value can close the attribute and inject an event handler such as onerror or onload.

Any authenticated user of the Pentestify instance can persist the payload through normal API workflows for adding evidence images or setting a client logo. Every subsequent user who opens, edits, or audits the report triggers execution of the stored script in the context of the Pentestify origin. This exposes session cookies, CSRF tokens, and any pentest data accessible to the victim.

Root Cause

The root cause is missing input validation on the server side and missing output encoding on the client side. The backend accepted arbitrary strings for image sources, and the frontend interpolated those strings into HTML attribute context without escaping quotes or restricting URI schemes.

Attack Vector

Exploitation is network-based and requires an authenticated session, but no user interaction beyond a victim opening the affected report. The attacker submits a crafted images entry or client_logo value that breaks out of the src attribute. When rendered, the injected handler runs JavaScript in the victim's browser under the Pentestify origin.

python

# Security patch in backend/schemas.py (v1.1.0)
# fix: validate image sources to prevent SSRF and stored XSS
-from pydantic import BaseModel
+from pydantic import BaseModel, field_validator
 from typing import List, Optional
 from datetime import datetime
+import re
+
+
+# Logos y evidencias solo pueden ser data URLs de imagen. Cualquier URL remota
+# se rechaza para evitar SSRF al generar el PDF y XSS al romper el atributo src.
+_DATA_IMAGE_RE = re.compile(r'^data:image/[a-zA-Z0-9.+-]+;base64,[A-Za-z0-9+/=\s]+$')
+
+
+def is_safe_image_src(value) -> bool:
+    return isinstance(value, str) and bool(_DATA_IMAGE_RE.match(value.strip()))
+
+
+def sanitize_image_list(values, keep_slots: bool = False) -> List[str]:
+    cleaned: List[str] = []
+    for v in (values or []):
+        if v == '' or is_safe_image_src(v):
+            cleaned.append(v)
+        elif keep_slots:
+            cleaned.append('')
+    return cleaned

Source: GitHub commit a058a22

Detection Methods for CVE-2026-59238

Indicators of Compromise

Entries in the Pentestify database where images[] or client_logo[] values do not match the data:image/<type>;base64,<payload> pattern.
Report records containing ", <, >, onerror=, onload=, or javascript: substrings in image source fields.
Outbound requests from Pentestify user browsers to unfamiliar domains immediately after opening a report.

Detection Strategies

Audit the Pentestify database for stored images and client_logo values that fail the ^data:image/[a-zA-Z0-9.+-]+;base64,[A-Za-z0-9+/=\s]+$ regex used in the v1.1.0 patch.
Inspect browser Content Security Policy (CSP) violation reports for img-src or inline-script violations originating from report views.
Review web server access logs for POST requests to report and finding endpoints containing HTML metacharacters in image fields.

Monitoring Recommendations

Enable a strict CSP with img-src 'self' data: and script-src 'self' on the Pentestify frontend to surface injection attempts.
Log and alert on authenticated API calls that write image or logo fields exceeding expected data-URL length or format.
Correlate report-view events with subsequent anomalous session token usage to identify successful XSS-driven session theft.

How to Mitigate CVE-2026-59238

Immediate Actions Required

Upgrade maalfer Pentestify to version 1.1.0 or later, which enforces data-URL validation on image inputs.
Purge or sanitize existing images and client_logo values in the database that do not match the safe data-URL pattern.
Rotate session secrets and force re-authentication for all Pentestify users after upgrading.

Patch Information

The fix is available in Pentestify v1.1.0, delivered in commit a058a22b42c6311895622645265df79a60265b1d. The patch introduces is_safe_image_src and sanitize_image_list in backend/schemas.py, restricting image sources to base64-encoded data:image/* URLs and rejecting any remote URL that could break out of the <img>src attribute or trigger SSRF during PDF rendering. See the GitHub commit and the Secur0 advisory for full details.

Workarounds

Restrict Pentestify access to trusted users only until the upgrade is applied, since exploitation requires an authenticated account.
Deploy a reverse-proxy WAF rule that rejects report and finding payloads containing HTML-breaking characters in image source fields.
Apply a strict Content Security Policy that blocks inline event handlers and disallows script execution from untrusted origins.

bash

# Upgrade Pentestify and validate the running version
git fetch --tags
git checkout v1.1.0
pip install -r requirements.txt
curl -s http://localhost:8000/openapi.json | jq '.info.version'
# Expected output: "1.1.0"