PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-73374 vulnerability-lookup CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-12T15:18:33.173Z and has not been modified since then. The vulnerability exists in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references[].tags[] were directly interpolated into HTML badge elements, bypassing Jinja's automatic HTML escaping due to markupsafe.Markup. An authenticated user could submit a crafted reference tag containing arbitrary HTML or JavaScript-capable markup, which would be stored and rendered as HTML when another user visited the vulnerability record page. Users with permissions to create or modify vulnerability records in Vulnerability-Lookup, as well as users who view public vulnerability record pages, should be aware of this stored XSS vulnerability and take steps to protect themselves and their users. Successful exploitation could allow an attacker to perform actions in the context of a victim, access information available to the victim's browser session, or modify page content. As the affected vulnerability pages can be accessed publicly, exploitation may affect users who are not authenticated.

Vendor
vulnerability-lookup
Product
Unknown
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-12
Original CVE updated
2026-08-26
Advisory published
2026-08-12
Advisory updated
2026-08-26

Who should care

Users with permissions to create or modify vulnerability records in Vulnerability-Lookup, as well as users who view public vulnerability record pages, should be aware of this stored XSS vulnerability and take steps to protect themselves and their users.

Technical summary

The render_tag_badges Jinja filter in Vulnerability-Lookup directly interpolated values from containers.cna.references[].tags[] into HTML badge elements without proper escaping, allowing an authenticated user with permission to create or modify vulnerability records to submit crafted reference tags containing arbitrary HTML or JavaScript. This stored XSS vulnerability could lead to JavaScript execution in the context of the Vulnerability-Lookup application when another user views the affected vulnerability record page.

Defensive priority

Authenticated users with permission to create or modify vulnerability records could exploit this stored XSS vulnerability, potentially affecting public users, with a CVSS score of 6.1.

Recommended defensive actions

  • Review and restrict user permissions for creating or modifying vulnerability records.
  • Implement additional input validation and sanitization for reference tags.
  • Monitor for suspicious activity on vulnerability record pages.
  • Consider applying compensating controls, such as Web Application Firewalls (WAFs).
  • Update to the latest version of Vulnerability-Lookup.

Evidence notes

The vulnerability exists in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references[].tags[] were directly interpolated into HTML badge elements, bypassing Jinja's automatic HTML escaping due to markupsafe.Markup. An authenticated user could submit a crafted reference tag containing arbitrary HTML or JavaScript-capable markup, which would be stored and rendered as HTML when another user visited the vulnerability record page.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-73374 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-73374

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-73374 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-73374

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/vulnerability-lookup/vulnerability-lookup/commit/d29901655c50cf3c25737d9ea86180268df51b57

    5a6e4751-2f3f-4070-9419-94fb35b644e8

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.