PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-38949 Youtu CVE debrief

CVE-2026-38949 is a high-severity Cross-Site Scripting (XSS) issue published on 2026-04-28 and updated on 2026-05-10. The vulnerability is described as affecting HTMLy 3.1.1 in the content creation workflow at /add/content?type=image, where user input is not properly sanitized and can lead to arbitrary script injection. NVD maps the weakness to CWE-79 and lists the CVSS v3.1 vector as AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L.

Vendor
Youtu
Product
Unknown
CVSS
HIGH 8.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-28
Original CVE updated
2026-05-10
Advisory published
2026-04-28
Advisory updated
2026-05-10

Who should care

Administrators and maintainers of HTMLy installations, especially environments that allow authenticated content creation or image-related publishing workflows. Security teams should also care if editors or contributors can reach the affected endpoint, because the reported vector requires privileges and user interaction but can impact confidentiality and integrity beyond the application boundary.

Technical summary

The reported issue is an XSS condition in the /add/content?type=image endpoint of HTMLy 3.1.1. According to the supplied description, the application fails to properly sanitize user-controlled input, enabling script injection. NVD classifies the weakness as CWE-79 and assigns a CVSS v3.1 score of 8.9 with scope changed (PR:L, UI:R), indicating the vulnerability is exploitable over the network but depends on an authenticated user path and a victim interaction.

Defensive priority

High. The score is 8.9 and the reported impact includes high confidentiality and integrity effects. Because the issue is tied to content creation and user interaction, it should be prioritized for patching, input validation review, and any exposure assessment on authoring or admin-facing workflows.

Recommended defensive actions

  • Update or remove the affected HTMLy 3.1.1 deployment if a fixed release or upstream mitigation is available.
  • Review the /add/content?type=image input path for server-side output encoding and allowlist-based sanitization.
  • Restrict access to content creation features to the minimum necessary roles.
  • Audit templates and rendering paths that may reflect or store user-supplied content from this endpoint.
  • Add regression tests for XSS payload handling in image/content creation flows.
  • Monitor application logs for unusual authoring requests and unexpected script-bearing input.

Evidence notes

The supplied corpus includes the NVD record, which lists the CVE as modified on 2026-05-10, marks vulnStatus as Deferred, and maps the weakness to CWE-79. References in the record point to a GitHub research README, the danpros/htmly repository, and a YouTube video. The vendor field in the provided metadata is inconsistent with the described product, so product attribution should be treated with caution until confirmed by upstream project guidance.

Official resources

Publicly disclosed on 2026-04-28 and last modified on 2026-05-10. NVD currently marks the record as Deferred. The supplied metadata contains references to a research README, the project repository, and a video walkthrough, but the vendor at