CVE-2026-78391: RansomLook Stored XSS Vulnerability

CVE-2026-78391 Overview

RansomLook contains a stored cross-site scripting (XSS) vulnerability [CWE-79] in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names ingested from external sources, including the public crowd-sourced ransomwhe.re feed, are stored without sufficient validation. The values are then embedded directly into an inline JavaScript onclick handler used by the CSV export button. Attackers can inject a crafted address containing quote characters and JavaScript syntax to escape the string literal and execute arbitrary code in the victim's browser session.

Critical Impact
Attacker-controlled JavaScript executes in the RansomLook web application context when a victim clicks the CSV export button, exposing session data and enabling actions with the victim's privileges. Exploitation may not require an authenticated RansomLook account when the malicious record is introduced via a consumed upstream feed.

Affected Products

RansomLook (open-source ransomware tracking project)
Deployments consuming the ransomwhe.re external feed
Versions prior to commit 7efb592

Discovery Timeline

2026-08-24 - CVE-2026-78391 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78391

Vulnerability Analysis

The vulnerability resides in the cryptocurrency wallet detail view of RansomLook. Wallet addresses and blockchain identifiers from untrusted upstream sources are rendered directly into an inline onclick JavaScript handler. Although Jinja HTML autoescaping is applied, it does not protect data inserted into a JavaScript string within an HTML attribute. The browser's HTML parser decodes entities such as ' before the attribute value is interpreted as JavaScript. A crafted cryptocurrency address containing quote characters and JavaScript syntax breaks out of the intended string literal.

Exploitation triggers when a user clicks the affected wallet's CSV export button. The injected payload executes in the security context of the RansomLook web application. This exposes information accessible to the victim and enables actions performed with the victim's privileges.

Root Cause

The root cause is context-inappropriate output encoding combined with missing input validation. HTML autoescaping is insufficient when untrusted data is placed inside a JavaScript string literal inside an HTML attribute. RansomLook accepted arbitrary characters in cryptocurrency addresses and blockchain names from external feeds, then reflected them into an executable JavaScript context.

Attack Vector

An attacker submits a malicious wallet record to a consumed upstream data source such as the crowd-sourced ransomwhe.re feed. RansomLook imports the record and stores it verbatim. When a RansomLook user views the wallet detail page and clicks the CSV export button, the injected JavaScript executes. Because ingestion is automated, the attack does not require an authenticated RansomLook account.

python

# Security patch in ransomlook/sharedutils.py
# Validates crypto addresses and blockchain names before storage
_CHAIN_RE = re.compile(r"^[a-z0-9][a-z0-9-]{0,31}$")
# Every one of the 11k+ addresses in production is strictly [A-Za-z0-9]; ':' and
# '-' are tolerated for the prefixed forms some chains use (CashAddr and the
# like) so a future importer is not rejected. Nothing here can close a quote,
# open a tag or a call: an address is rendered into HTML and into Redis keys,
# and ransomwhe.re is an untrusted upstream.
_CRYPTO_ADDR_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9:_-]{0,127}$")


def is_valid_chain(value: Any) -> bool:
    """True when `value` is usable as a blockchain name."""
    return isinstance(value, str) and bool(_CHAIN_RE.match(value))


def is_valid_crypto_address(value: Any) -> bool:
    """True when `value` is safe to store and render as a wallet address."""
    return isinstance(value, str) and bool(_CRYPTO_ADDR_RE.match(value))

Source: RansomLook Commit 7efb592

Detection Methods for CVE-2026-78391

Indicators of Compromise

Cryptocurrency address records containing quote characters (', "), angle brackets, parentheses, or JavaScript keywords such as alert, onerror, or document.cookie.
Blockchain name fields that fail the ^[a-z0-9][a-z0-9-]{0,31}$ character policy.
Wallet records imported from ransomwhe.re or other upstream feeds with unusually long address strings exceeding 128 characters.
Unexpected outbound requests originating from analyst browser sessions after viewing wallet detail pages.

Detection Strategies

Query the RansomLook datastore for stored cryptocurrency addresses that do not match the sanitized regular expressions introduced in commit 7efb592.
Inspect rendered HTML of the wallet detail view for anomalous onclick handler payloads.
Correlate web server access logs with browser telemetry to identify session anomalies immediately after /wallet/ route access.

Monitoring Recommendations

Log and alert on ingestion of records from external feeds that contain non-alphanumeric characters in address or chain fields.
Monitor analyst workstations for browser-initiated network activity following visits to RansomLook wallet pages.
Track content security policy (CSP) violation reports from the RansomLook front end.

How to Mitigate CVE-2026-78391

Immediate Actions Required

Update RansomLook to the version containing commit 7efb59253f23552538f9a11c9bf21e7bcfcc1319 or later.
Purge existing stored cryptocurrency addresses and blockchain names that fail the new validation regexes.
Re-ingest data from upstream feeds only after validation is enforced.
Instruct analysts to avoid using the CSV export button on wallet detail pages until the patch is deployed.

Patch Information

The upstream fix is delivered in the RansomLook commit 7efb592. It introduces is_valid_chain and is_valid_crypto_address validators in ransomlook/sharedutils.py, applies them during ingestion in bin/cryptocur.py, and refactors the wallet detail template to replace the inline onclick handler with data-* attributes bound to an external event listener. Wallet values are treated strictly as data rather than executable JavaScript.

Workarounds

Disable ingestion from untrusted upstream feeds such as ransomwhe.re until the patch is applied.
Deploy a strict Content Security Policy that blocks inline event handlers and inline scripts on the RansomLook origin.
Restrict access to the RansomLook interface to trusted analysts on segmented networks.

bash

# Update to patched RansomLook revision
cd /opt/RansomLook
git fetch origin
git checkout 7efb59253f23552538f9a11c9bf21e7bcfcc1319
# Restart the RansomLook service after upgrading dependencies
pip install -r requirements.txt
systemctl restart ransomlook