CVE-2026-75531: Pandora Stored XSS Vulnerability

CVE-2026-75531 Overview

CVE-2026-75531 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Pandora, an open-source file analysis platform maintained by the Pandora Analysis project. The flaw exists in the rendering of URL observables tied to the Submit to Lookyloo action. A URL extracted from an analyzed file is embedded directly into an inline JavaScript onclick handler. Although the template engine applies HTML escaping, the value sits inside a JavaScript string within an HTML attribute, so crafted characters can break out of the string and inject arbitrary script.

Critical Impact
An attacker who controls a URL observable in an analyzed file can execute JavaScript in the victim's Pandora session, exposing sensitive data and enabling authenticated actions.

Affected Products

Pandora file analysis platform (pandora-analysis/pandora)
Instances rendering URL observables through the Submit to Lookyloo control
Deployments prior to commit 77a84a039e2079dba7ea0342816c9813099d75d0

Discovery Timeline

2026-08-17 - CVE-2026-75531 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75531

Vulnerability Analysis

The vulnerability affects the lookyloo JavaScript function used by the Pandora analysis UI. The server-side template rendered URL observables directly into the onclick attribute of the Submit to Lookyloo button. HTML entity escaping is not sufficient in this context, because the value is parsed as a JavaScript string literal after HTML decoding. An attacker who submits or references a file containing a crafted URL observable can inject a payload that closes the string literal and appends arbitrary JavaScript. Execution occurs when an analyst interacts with the affected control, giving the attacker access to any data or actions available to the victim's authenticated session.

Root Cause

The root cause is an unsafe context-mixing pattern: server-side HTML escaping applied to data that will be interpreted as JavaScript. Characters such as backticks, quotes, and backslashes bypass HTML escaping while remaining syntactically meaningful in a JavaScript string, permitting escape from the string literal. Additional uses of innerHTML in the same code path compounded the risk by allowing further DOM-based injection.

Attack Vector

Exploitation requires an attacker to place a malicious URL observable into a file that a Pandora user later analyzes. The vector is network-based and requires user interaction: the victim must interact with the Submit to Lookyloo control on the analysis page. Successful exploitation grants the attacker JavaScript execution in the origin of the Pandora web application.

javascript

// Patch excerpt from website/web/static/js/analysis.js
// Before: url_to_submit was passed inline via onclick handler
// After: value is read from a data-url attribute via the DOM dataset API

-async function lookyloo(lookyloo_url, sha256, url_to_submit) {
+async function lookyloo(lookyloo_url, sha256) {
+  let url_to_submit = document.getElementById(`lookyloo_submit-${sha256}`).dataset.url;
   let uuid = await LookylooSubmit(lookyloo_url, url_to_submit);
   document.getElementById(`lookyloo_submit-${sha256}`).style.display = 'none';
   document.getElementById(`lookyloo_link-${sha256}`).style.display = 'block';

Source: GitHub Commit 77a84a0

Detection Methods for CVE-2026-75531

Indicators of Compromise

URL observables containing JavaScript string-breakout characters such as backticks, single quotes, or backslashes followed by script-like tokens.
Unexpected outbound requests from analyst browsers to attacker-controlled endpoints after viewing analysis results.
Pandora session cookies or API tokens appearing in referer or query parameters of external requests.

Detection Strategies

Inspect rendered HTML of analysis pages for onclick handlers containing untrusted URL values instead of a data-url attribute reference.
Review web server and reverse proxy logs for analyzed submissions whose URL observables include quotes, backticks, or </script> sequences.
Compare deployed static assets against the fixed Subresource Integrity (SRI) hash for analysis.js published in the patch commit.

Monitoring Recommendations

Enable and monitor Content Security Policy (CSP) violation reports for inline script and event handler executions in the Pandora origin.
Alert on Pandora analyst accounts performing atypical API actions immediately after opening a specific analysis, indicating possible session-riding.
Correlate authentication events with browser telemetry to identify script executions originating from the analysis view.

How to Mitigate CVE-2026-75531

Immediate Actions Required

Upgrade Pandora to a build that includes commit 77a84a039e2079dba7ea0342816c9813099d75d0 or later.
Restrict Pandora access to trusted analyst networks and require authenticated sessions.
Rotate session tokens and API keys for accounts that may have interacted with untrusted analyses before patching.

Patch Information

The upstream patch removes the observable value from the inline JavaScript handler. The URL is now stored in an HTML data-url attribute and retrieved through the DOM dataset API when the Submit to Lookyloo action fires. Additional innerHTML assignments were replaced with textContent as defensive hardening. See the Pandora security patch commit for the full diff and updated SRI hashes.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and inline event handlers on the Pandora origin.
Instruct analysts to avoid interacting with the Submit to Lookyloo control on submissions from untrusted sources until the patch is applied.
Front Pandora with a reverse proxy that rewrites or blocks responses containing suspicious characters inside onclick attributes.

bash

# Apply the upstream fix by pulling the patched commit
cd /opt/pandora
git fetch origin
git checkout 77a84a039e2079dba7ea0342816c9813099d75d0
# Rebuild static assets and restart the Pandora service
systemctl restart pandora