CVE-2026-97233 Details
Description
A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument file_path leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
A stored DOM-based cross-site scripting vulnerability has been identified in Volotat Anagnorisis versions through 0.4.11. The issue arises in the PlaylistManager.js file within the Media Filename Handler component. The vulnerability is triggered by manipulating the file_path argument, which leads to the execution of injected HTML when the music playlist is accessed. This exploitation occurs with the same-origin privileges of the Anagnorisis application.
To address this vulnerability, it is recommended to build HTML elements using DOM APIs or jQuery methods that safely handle text. Filenames should be assigned with textContent or jQuery's text() method, and data attributes with jQuery's attr() or data() methods. Additionally, other file-path sinks that use innerHTML or jQuery HTML methods should be replaced with safe text handling. Implementing a strict Content Security Policy can provide an extra layer of security, but should not be the sole solution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://note-hxlab.wetolink.com/share/qA4ZLotZKWmj | [email protected] | ExploitRemedyTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-97233 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/908267 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/409323 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/409323/cti | [email protected] | Content WallVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| volotat Anagnorisis | >= 0.4.0, <= 0.4.11 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |