Vulnerability-Lookup up to 5.5.1 Tag Rendering render_tag_badges cross site scripting

Summaryinfo

A vulnerability was found in Vulnerability-Lookup up to 5.5.1 and classified as problematic. Affected is the function render_tag_badges of the component Tag Rendering. Such manipulation leads to cross site scripting. This vulnerability is documented as CVE-2026-73374. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Vulnerability-Lookup up to 5.5.1. Affected by this issue is the function render_tag_badges of the component Tag Rendering. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references[].tags[] were directly interpolated into HTML badge elements and the resulting string was wrapped in markupsafe.Markup. Because Markup marks the generated content as safe, Jinja's automatic HTML escaping was bypassed. An authenticated user with permissions to create or modify vulnerability records, such as a user holding the vulnerability:create or vulnerability:modify permission, could submit a crafted reference tag through the CNA API containing arbitrary HTML or JavaScript-capable markup. The malicious value would subsequently be stored as part of the vulnerability record. When another user visited the corresponding public /cve/<id> or /vuln/<id> page, the crafted tag would be rendered as HTML in the viewer's browser. This could result in JavaScript execution in the security context of the Vulnerability-Lookup application. Successful exploitation could allow an attacker to perform actions in the context of a victim, access information available to the victim's browser session, or modify page content. As the affected vulnerability pages can be accessed publicly, exploitation may affect users who are not authenticated. The issue was corrected by applying markupsafe.escape() to each reference tag before inserting it into the HTML badge markup, while retaining Markup only for the static HTML scaffolding.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-73374 since 08/12/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Applying the patch d29901655c50cf3c25737d9ea86180268df51b57 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Vulnerability-Lookup

Version

• 5.5.0
• 5.5.1

Website

• Product: https://github.com/vulnerability-lookup/vulnerability-lookup/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion