CVE-2026-57532

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description Malicious HTML content within the layout specification of a PDF ticket or badge layout is executed when the PDF editor is opened in the browser. This allows a backend user to inject JavaScript into the browser context of another backend user. This is possible because the PDF rendering and editing libraries used prevent the implementation of a strong Content-Security-Policy (CSP), which is a security layer that helps detect and mitigate certain types of attacks, including cross-site scripting.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.