What is GHSA-hpcr-c79h-7cww?

GHSA-hpcr-c79h-7cww is a security advisory published by GitHub Security Advisories with Medium severity. Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview...

Which CVE IDs does GHSA-hpcr-c79h-7cww cover?

GHSA-hpcr-c79h-7cww covers the following CVE IDs: CVE-2026-59238. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-hpcr-c79h-7cwwMedium

Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview...

Vendor

GitHub Security Advisories

Published

July 20, 2026

Last Modified

July 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-59238 →

📋 Description

Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an src attribute without escaping.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-59238
https://github.com/maalfer/pentestify/commit/a058a22b42c6311895622645265df79a60265b1d
https://secur0.com/en/cna/cve-list/cve-2026-59238-stored-xss-in-pentestify-via-unsanitized-finding-images-and-report-client-logo
https://github.com/advisories/GHSA-hpcr-c79h-7cww