CVE-2026-126798: NextScan 1.1.0 through 1.2.0 Stored XSS via URL Asset Detail View
NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (AssetURL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the ns-admin interface who view URL asset details for crawled content are exposed. An attacker-controlled crawled form can cause script execution in that user's browser, including for administrator users.
What must an attacker do to exploit it?
The attacker must host a crafted form on a site that NextScan crawls so its request body is stored as Asset_URL.data. The victim must then open the affected URL asset detail dialog in ns-admin.
Are credentials required to trigger the stored payload?
No attacker privileges are identified as required. However, exploitation relies on persuading or causing NextScan to crawl attacker-controlled content and on a user viewing the stored asset details.
What is the likely impact after successful exploitation?
The injected JavaScript can steal localStorage access tokens and use them to hijack sessions. This can include administrator sessions when an administrator views the affected asset detail.