ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-78391

RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view.

Published Aug 24, 2026 · catalog updated Oct 14, 2026 · RansomLook contains a stored

Check if you run it

No confirmed exploitation is on record for CVE-2026-78391. EPSS is 0.44%. Act only if a listed version of RansomLook contains a stored is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (RansomLook contains a stored).
  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High8.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.44%
Remediation
Not established
Affected products
See sources for product scope

RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later embedded directly into an inline JavaScript onclick handler. Although Jinja HTML autoescaping was applied, it does not provide adequate protection when untrusted data is inserted into a JavaScript string inside an HTML attribute. HTML entities such as ' are decoded by the browser's HTML parser before the resulting attribute is interpreted as JavaScript. Consequently, a specially crafted cryptocurrency address containing quote characters and JavaScript syntax could escape the intended string literal and execute arbitrary JavaScript when a user clicked the affected wallet's CSV export button. Because cryptocurrency information imported from an untrusted upstream could reach the vulnerable rendering path, exploitation may not require an authenticated RansomLook account if an attacker can introduce a malicious wallet record into a consumed external data source. Successful exploitation could allow attacker-controlled JavaScript to execute in the security context of the RansomLook web application, potentially exposing information accessible to the victim or performing actions with the victim's privileges. The patch mitigates the issue by validating cryptocurrency addresses and blockchain identifiers before storage, restricting them to a safe character set, and replacing the inline JavaScript handler with data-* attributes and an external event listener so wallet values are treated strictly as data rather than executable JavaScript.

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.

How to fix CVE-2026-78391

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-78391. EPSS is 0.44%. Act only if a listed version of RansomLook contains a stored is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-79: Cross-site Scripting (XSS). EPSS 0.44%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 24, 2026 · NIST NVD

    Detected

    RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later embedded directly into an inline JavaScript onclick handler. Although Jinja HTML autoescaping was app

  2. Oct 14, 2026 · NIST NVD

    Updated

    RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later embedded directly into an inline JavaScript onclick handler. Although Jinja HTML autoescaping was app

Sources

  • CVE.orgVulnerability recordCVE-2026-78391

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-78391

    30-day exploitation probability 0.4%

    first.org
  • NIST NVDVulnerability recordCVE-2026-78391

    RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient va

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.