CVE-2026-66824

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A stored cross-site scripting issue exists on the capture tree visualization page. The application embeds serialized capture tree data directly into an inline JavaScript block using the Jinja safe filter. Since this data can include attacker-controlled web content, a crafted value can terminate the <script> element and inject arbitrary HTML or JavaScript. This allows the execution of malicious code in the browser of a user viewing the capture tree, potentially enabling the attacker to perform actions via the victim's authenticated session, access sensitive information, or modify application data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.