CVE-2026-73374 in Vulnerability-Lookup
Summary
by MITRE • 08/12/2026
A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records.
Values from containers.cna.references[].tags[] were directly interpolated into HTML badge elements and the resulting string was wrapped in markupsafe.Markup. Because Markup marks the generated content as safe, Jinja's automatic HTML escaping was bypassed.
An authenticated user with permissions to create or modify vulnerability records, such as a user holding the vulnerability:create or vulnerability:modify permission, could submit a crafted reference tag through the CNA API containing arbitrary HTML or JavaScript-capable markup.
The malicious value would subsequently be stored as part of the vulnerability record. When another user visited the corresponding public /cve/<id> or /vuln/<id> page, the crafted tag would be rendered as HTML in the viewer's browser. This could result in JavaScript execution in the security context of the Vulnerability-Lookup application.
Successful exploitation could allow an attacker to perform actions in the context of a victim, access information available to the victim's browser session, or modify page content. As the affected vulnerability pages can be accessed publicly, exploitation may affect users who are not authenticated.
The issue was corrected by applying markupsafe.escape() to each reference tag before inserting it into the HTML badge markup, while retaining Markup only for the static HTML scaffolding.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
This stored cross-site scripting vulnerability resides within the Vulnerability-Lookup application's rendering logic for reference tags associated with vulnerability records. The flaw manifests in the render_tag_badges Jinja filter which processes container.cna.references[].tags[] values and directly interpolates them into HTML badge elements without proper sanitization. The vulnerability represents a classic stored XSS scenario where malicious input persists in the application's database and executes during subsequent page renders.
The technical implementation of this vulnerability stems from improper handling of untrusted data within the Jinja templating system. When reference tags are processed through the render_tag_badges filter, the values are wrapped in markupsafe.Markup which explicitly marks the content as safe for HTML rendering. This bypasses Jinja's automatic HTML escaping mechanisms that would normally prevent malicious script execution. The vulnerability is classified under CWE-79 as "Improper Neutralization of Input During Web Page Generation" and specifically demonstrates CWE-80 as "Cross-site Scripting (XSS) - Filtered Escape Sequences".
The operational impact of this vulnerability extends beyond simple data corruption or display issues. An authenticated user with appropriate permissions such as vulnerability:create or vulnerability:modify can inject malicious JavaScript code through the CNA API interface. This crafted content becomes permanently stored within vulnerability records and executes whenever any user—authenticated or not—visits the corresponding public CVE or vuln pages. The attack vector leverages the ATT&CK technique T1059.001 for Command and Scripting Interpreter, specifically JavaScript execution within a web browser context.
The security implications are particularly concerning given the public accessibility of vulnerability pages. Any user visiting affected pages becomes a potential victim of this stored XSS attack, allowing attackers to perform actions such as stealing session cookies, modifying page content, or redirecting users to malicious sites. The vulnerability creates a persistent threat that affects all users regardless of authentication status, making it particularly dangerous in security applications where trust and data integrity are paramount.
The remediation approach addresses the root cause by implementing proper input sanitization through markupsafe.escape() before incorporating reference tags into HTML badge markup. This solution maintains the Markup wrapper only for static HTML scaffolding elements while ensuring dynamic content is properly escaped, thereby preventing XSS execution paths. The fix aligns with security best practices for web application development and represents a standard defensive measure against stored cross-site scripting vulnerabilities in templating environments.