Cross-Site Scripting Vulnerability in Hayabusa by Yamato Security
CVE-2026-40028

5.1MEDIUM

Key Information:

Vendor: Yamato-security
Status: Hayabusa
Vendor: CVE Published:; 8 April 2026

🔔 Create Yamato-security Vulnerability Alert

What is CVE-2026-40028?

A cross-site scripting vulnerability exists in Hayabusa versions before 3.8.0 that enables attackers to inject malicious JavaScript within the HTML report output. This occurs when a user scans JSON-exported logs where the 'Computer' field contains harmful content. If a forensic examiner views the generated HTML report, the injected JavaScript can execute in their browser session, potentially leading to sensitive information disclosure or unauthorized code execution.