Cross-Site Scripting Vulnerability in PrivateBin Before 2.0.5

CVE-2026-55696

What is CVE-2026-55696?

PrivateBin, a secure online pastebin tool, experienced vulnerabilities prior to version 2.0.5 that could allow an attacker to exploit the attachment feature. The AttachmentViewer.setAttachment function in js/privatebin.js failed to properly handle MIME types, allowing potentially harmful content to be attached and subsequently executed. If the server's Content Security Policy is weakened or missing, an attacker can craft a malicious attachment. When a victim engages with this attachment, malicious inline JavaScript could execute within the PrivateBin context, exposing sensitive origin-scoped information such as local storage. This weakness highlights the importance of strict MIME type validation and robust security policies in web applications.

References