Stored Cross-Site Scripting Vulnerability in Pandora by Pandora Analysis

CVE-2026-75531

What is CVE-2026-75531?

Pandora contains a stored cross-site scripting (XSS) vulnerability related to the rendering of URL observables, enabling attackers to inject arbitrary JavaScript code. This occurs when a URL, extracted from an analyzed file, is directly embedded in the inline JavaScript onclick handler used by the 'Submit to Lookyloo' action. Although initial escaping is applied, the context of embedding within an HTML attribute allows an attacker-controlled URL with crafted characters to escape the JavaScript string. When successfully exploited, this vulnerability enables an attacker to execute scripts in the context of the Pandora web application, potentially accessing sensitive information from the victim's browser or performing unauthorized actions using the victim’s authenticated session. A patch has been implemented to mitigate this issue by removing the observable value from the inline JavaScript handler, storing the URL in a secure HTML data attribute instead.

References