Stored Cross-Site Scripting Vulnerability in Mythic by its-a-feature
CVE-2026-119764

7.4HIGH

Key Information:

Vendor

Its-a-feature

Status
Mythic
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119764?

Mythic versions 3.2.16 through 3.4.0.61 are susceptible to a stored cross-site scripting vulnerability, which allows attackers to execute JavaScript within the Mythic UI. This is facilitated by manipulating .pdf-named files with embedded HTML. When users download and preview these files, the injected content is rendered in the same origin context. This vulnerability enables the theft of localStorage JSON Web Tokens (JWTs), granting unauthorized access to both GraphQL and REST APIs.

Affected Version(s)

Mythic 3.2.16 <= 3.4.0.61

References

https://github.com/h00die/mythic_xss
third-party-advisory
https://github.com/its-a-feature/Mythic/commit/f06b3ed2d1...
patch
https://github.com/its-a-feature/Mythic/blob/33a46d7db7e2...
technical-description

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

h00die
.