CVE-2026-49864 butlerx CVE debrief

Who should care

Defenders responsible for SSH session security and wetty service administration should assess exposure and prioritize patching to version 3.0.4 or later. Operators, platforms, vulnerability-management teams, and security teams may be impacted by this vulnerability and should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-49864 is a high-severity vulnerability in the wetty terminal access service that allows an attacker to inject script into the victim's browser and execute arbitrary keystrokes in their SSH session. Defenders responsible for SSH session security and wetty service administration should assess exposure and prioritize patching to version 3.0.4 or later.

• attacker can inject script into victim's browser
• attacker can execute arbitrary keystrokes in victim's SSH session
• patching to version 3.0.4 or later is required

Technical summary

The wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string. This allows an attacker to inject script into the victim's browser and execute arbitrary keystrokes in their SSH session. The vulnerability can be mitigated by patching to version 3.0.4 or later and verifying SSH session security. Affected product context and defensive impact should be considered when assessing exposure and prioritizing patching. The vulnerability class is related to improper handling of user input in the wetty terminal access service.

Defensive priority

Defenders should prioritize patching to version 3.0.4 or later and verify SSH session security.

Recommended defensive actions

• Patch wetty to version 3.0.4 or later
• Verify SSH session security
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from the CVE record and NVD detail page indicates that the vulnerability exists in versions prior to 3.0.4 and that patching is required. The CVE record and NVD detail page provide source-provided CVE metadata and official NIST NVD detail page and source-specific vulnerability assessment. Defenders should verify SSH session security and review compensating controls for exposed systems while remediation is scheduled and verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.