CVE-2026-19744: Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotes
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maalfer Pentestifyto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19744?
CVE-2026-19744 has a risk score of 48, indicating a moderate severity level for this stored cross-site scripting vulnerability.
How do I fix CVE-2026-19744?
To fix CVE-2026-19744, upgrade to maalfer Pentestify version 2.3.2 or later where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-19744?
CVE-2026-19744 is categorized as a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-19744?
Authenticated users of the maalfer Pentestify software prior to version 2.3.2 are affected by CVE-2026-19744.
What does CVE-2026-19744 allow an attacker to do?
CVE-2026-19744 allows an attacker to execute arbitrary JavaScript in the application origin through specially crafted Markdown links containing unescaped quotes.