CVE-2026-63356: XSS
Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the resulting error message is displayed.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who have the “Read diagnostics” function right and can be persuaded to import a specially crafted CSV trace file are exposed. The attacker does not need prior privileges, but exploitation requires user interaction.
What must an attacker do to exploit it?
An attacker must create a CSV trace file containing a malicious calculated signal name and convince an authorized user to import it on the Trace page. The JavaScript executes when the resulting error message is displayed.
What can be done if patching is not immediately possible?
Limit access to the “Read diagnostics” function right and prevent users from importing untrusted CSV trace files. Treat trace files received from external or unverified sources as potentially malicious.