CVE-2026-40028
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
XSS vulnerability in Hayabusa before version 3.8.0. An attacker can inject JavaScript in the Computer field of JSON logs, which executes in the analyst's browser when viewing the HTML report.
Risk Assessment
An attacker can steal the analyst's data or gain access to the system, compromising the confidentiality of the investigation.
Recommendation
Update Hayabusa to version 3.8.0 or later.
Original NVD description (English source)
Hayabusa versions prior to 3.8.0 contain a cross-site scripting (XSS) vulnerability in its HTML report output that allows an attacker to execute arbitrary JavaScript when a user scans JSON-exported logs containing malicious content in the Computer field. An attacker can inject JavaScript into the Computer field of JSON logs that executes in the forensic examiner's browser session when viewing the generated HTML report, leading to information disclosure or code execution.