CVE-2026-90821: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Crafty Controllerto a version that resolves this vulnerability.Fixed in 4.11.0
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker must be remote and authenticated, and must be able to submit malicious input through the Webhook URL form field.
What interaction is required for exploitation?
The vulnerability requires user interaction. The supplied data does not specify which user must interact with the stored payload or what page must be viewed.
What is the likely impact if exploitation succeeds?
The CVSS vector indicates low confidentiality and integrity impact, with no availability impact. Because scope is changed, the XSS may affect a security authority beyond the vulnerable component.