CVE-2026-78391

Name of the Vulnerable Software and Affected Versions RansomLook (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists in the cryptocurrency wallet detail view. The application stores cryptocurrency addresses and blockchain names from external sources, such as the public crowd-sourced ransomwhe.re feed, without sufficient validation. This data is subsequently embedded into an inline JavaScript onclick handler. While Jinja HTML autoescaping is used, it fails to protect data inserted into a JavaScript string within an HTML attribute because the browser decodes HTML entities before interpreting the attribute as JavaScript. An attacker can provide a crafted cryptocurrency address containing quote characters and JavaScript syntax to execute arbitrary code when a user clicks the CSV export button. This may occur without an authenticated account if malicious records are introduced into an external data source, allowing the execution of scripts in the security context of the web application to expose information or perform unauthorized actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Validate cryptocurrency addresses and blockchain identifiers before storage by restricting them to a safe character set. Replace inline JavaScript handlers with data-* attributes and external event listeners to ensure wallet values are treated as data rather than executable code.