CVE-2026-79719: XSS
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects the Netron desktop application in versions 9.1.2 and earlier. The provided data does not indicate whether any particular operating system, packaging method, or configuration changes exposure.
What must an attacker control to exploit this issue?
An attacker needs to provide node names that reach the desktop application's rendering path without sanitization. The data does not specify how a victim would obtain or open content containing those node names.
What could exploitation enable?
The reported impact includes hiding certain nodes and performing port scanning. The advisory also states that a Chrome n-day could be abused to achieve remote code execution, indicating that RCE depends on an additional Chrome vulnerability rather than this XSS alone.