Reflected Cross-Site Scripting Vulnerability in Mongoose Web Server

CVE-2026-73259

What is CVE-2026-73259?

The Mongoose web server, before version 7.22, contains a reflected cross-site scripting vulnerability that allows remote attackers to craft a malicious percent-encoded request path. When a user is persuaded to access this crafted URL, the server fails to properly sanitize the request URI before reflecting it back in the HTML title and h1 elements. This lack of HTML entity encoding can enable attackers to execute arbitrary scripts in the context of the user's session, potentially compromising sensitive session data and executing unintended actions on behalf of the victim. The issue has been addressed in the Mongoose release version 7.22.

References