CVE-2026-73374: Vulnerability-Lookup XSS Vulnerability

CVE-2026-73374 Overview

CVE-2026-73374 is a stored cross-site scripting (XSS) vulnerability in Vulnerability-Lookup. The flaw resides in the render_tag_badges Jinja filter, which displays reference tags associated with vulnerability records. Values from containers.cna.references[].tags[] were interpolated directly into HTML badge elements, and the resulting string was wrapped in markupsafe.Markup. Because Markup marks content as safe, Jinja's automatic HTML escaping was bypassed. An authenticated user with vulnerability:create or vulnerability:modify permissions could submit a crafted reference tag containing arbitrary HTML or JavaScript through the CNA API. The payload persists in the vulnerability record and executes when any visitor loads the public /cve/<id> or /vuln/<id> page.

Critical Impact
Stored XSS payloads execute in the browser context of any user viewing an affected vulnerability page, including unauthenticated visitors, enabling session-scoped actions and content modification.

Affected Products

Vulnerability-Lookup (vulnerability-lookup/vulnerability-lookup)
Versions prior to commit d29901655c50cf3c25737d9ea86180268df51b57
Deployments exposing /cve/<id> or /vuln/<id> pages publicly

Discovery Timeline

2026-08-12 - CVE-2026-73374 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73374

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. The render_tag_badges Jinja filter in website/web/filters/__init__.py constructs HTML badge markup from reference tag values and wraps the complete string with markupsafe.Markup. Markup signals to Jinja that the content is already safe, which disables the default HTML auto-escape behavior for the entire wrapped fragment, including untrusted user input.

An attacker with vulnerability:create or vulnerability:modify permissions submits a reference tag containing HTML or <script> markup through the CNA API. The malicious tag is stored as part of the vulnerability record. When another user visits the corresponding /cve/<id> or /vuln/<id> page, the crafted tag renders as HTML and executes JavaScript in the security context of the Vulnerability-Lookup origin. Because these vulnerability pages are publicly accessible, exploitation impacts unauthenticated visitors as well as authenticated users.

Root Cause

The root cause is unsafe use of markupsafe.Markup around a string built by concatenating user-controlled tag values with static HTML scaffolding. Markup should be reserved for trusted, developer-authored HTML fragments. Wrapping attacker-controlled input in Markup marks it as safe and bypasses Jinja's automatic escaping, allowing raw HTML and script content to render.

Attack Vector

Exploitation requires an authenticated account with permission to create or modify vulnerability records. The attacker submits a crafted containers.cna.references[].tags[] value through the CNA API. Once stored, the payload triggers on victim browsers on subsequent page loads of the affected vulnerability record. No user interaction beyond visiting the public page is required.

python

 from dateutil.parser import parse  # type: ignore[import-untyped]
 from gcve import to_gcve_id
 from markdown.extensions.tables import TableExtension  # type: ignore[import-untyped]
-from markupsafe import Markup
+from markupsafe import Markup, escape
 
 from website.lib.constants import ALLOWED_ATTRIBUTES, ALLOWED_TAGS
 from website.lib.sanitizers import sanitize_html_fragment

Source: GitHub Commit d299016. The patch imports escape from markupsafe and applies it to each reference tag before insertion into the badge markup, while retaining Markup only for the static HTML scaffolding.

Detection Methods for CVE-2026-73374

Indicators of Compromise

Vulnerability records containing <script>, onerror=, onload=, or other event-handler attributes inside containers.cna.references[].tags[] values.
CNA API submissions from accounts with vulnerability:create or vulnerability:modify permissions containing HTML metacharacters in tag fields.
Unexpected outbound requests from client browsers viewing /cve/<id> or /vuln/<id> endpoints to attacker-controlled hosts.

Detection Strategies

Query the vulnerability datastore for stored tag values matching regular expressions such as <[a-zA-Z] or javascript: to surface latent payloads.
Inspect CNA API access logs for tag submissions containing angle brackets, quote characters, or URL-encoded HTML.
Review browser Content Security Policy (CSP) violation reports for inline-script and event-handler violations originating from vulnerability detail pages.

Monitoring Recommendations

Log all writes to vulnerability records that modify the references[].tags[] array, including the submitting account and payload contents.
Alert on anomalous tag submission volume or content length from accounts holding vulnerability:create or vulnerability:modify roles.
Monitor for unauthorized privilege grants that would enable an attacker to obtain the required CNA permissions.

How to Mitigate CVE-2026-73374

Immediate Actions Required

Update Vulnerability-Lookup to a build that includes commit d29901655c50cf3c25737d9ea86180268df51b57 or later.
Audit existing vulnerability records for stored payloads in reference tag fields and sanitize or remove offending entries.
Review the account roster for users holding vulnerability:create or vulnerability:modify permissions and revoke unnecessary access.

Patch Information

The fix is available in the upstream repository at vulnerability-lookup commit d299016. The patch applies markupsafe.escape() to each reference tag before insertion into the HTML badge markup, while retaining Markup only for the static scaffolding. Operators should rebuild and redeploy the affected web application after pulling the patched commit.

Workarounds

Restrict CNA API write permissions to trusted operators until the patch is deployed.
Deploy a strict Content Security Policy that disallows inline scripts and event handlers on vulnerability detail pages.
Place a web application firewall rule in front of the CNA API to reject tag submissions containing HTML metacharacters.

bash

# Update to the patched revision
git fetch origin
git checkout d29901655c50cf3c25737d9ea86180268df51b57
# Rebuild and restart the Vulnerability-Lookup service
pip install -r requirements.txt
systemctl restart vulnerability-lookup