CVE-2026-57325

The vulnerability allows an unauthenticated attacker to inject malicious script (XSS) in NanoMag version 1.8 and earlier. The attack can be performed without authentication, increasing the risk for users.

The risk involves potential session theft, redirection to malicious sites, or other actions in the victim's browser context, which may lead to data confidentiality breaches.

It is recommended to immediately update to the latest version of NanoMag that fixes this vulnerability. If an update is not available, apply temporary mitigations such as input filtering.