{"id":"CVE-2026-119735","kind":"vulnerability","aliases":["CVE-2026-119735"],"related":[],"title":"Munshi by Petpooja: stored script injection in purchase inquiry threads","description":"Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}), which is assigned to innerHTML during rendering before text cleaning completes. Attackers can store a payload that executes in the browser of another user who opens the affected thread, achieving JavaScript execution and full-page defacement that re-triggers whenever the thread is reopened.","summary":"Munshi, a restaurant management product from Petpooja, rendered user-submitted item descriptions and messages in the Purchase Inquiry thread as raw HTML before cleaning them. A logged-in user can store a script that runs in the browser of anyone who opens that thread.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["munshi","other","petpooja","restaurant-software"],"not_affected_if":["updated-after-2026-07-13"],"how_to_check":"- Confirm whether your team uses Munshi by Petpooja and which version is deployed, since the sources only say the flaw existed before 2026-07-13.\n- Check whether the Purchase Inquiry thread feature is in use (`/purchase-inquiry/thread/{thread-id}`).","fix":"- Move to a Munshi build released on or after 2026-07-13, as stated in the sources; the exact version is unknown.","status":"open","published_at":"2026-11-02T19:18:02+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","triaged_at":"2026-11-02T19:26:51+00:00","updated_at":"2026-11-02T19:26:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-02T19:26:51Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Munshi build released on or after 2026-07-13, as stated in the sources; the exact version is unknown.","reach":"network","title":"Munshi by Petpooja: stored script injection in purchase inquiry threads","impact":"medium","summary":"Munshi, a restaurant management product from Petpooja, rendered user-submitted item descriptions and messages in the Purchase Inquiry thread as raw HTML before cleaning them. A logged-in user can store a script that runs in the browser of anyone who opens that thread.","audience":"businesses","category":"other","nicknames":[],"who_cares":["munshi","petpooja","restaurant-software"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs scripts in other users' browsers, defacing pages and taking actions as them.","analyst_note":"","how_to_check":"- Confirm whether your team uses Munshi by Petpooja and which version is deployed, since the sources only say the flaw existed before 2026-07-13.\n- Check whether the Purchase Inquiry thread feature is in use (`/purchase-inquiry/thread/{thread-id}`).","plain_action":"","needs_analyst":false,"not_affected_if":["updated-after-2026-07-13"],"who_is_affected":"Teams running Munshi by Petpooja before the 2026-07-13 release, particularly where several staff log in and use the Purchase Inquiry threads. Exposure depends on who can create content and who views the threads. The sources do not say which deployment models are affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000712,"input_tokens":4237,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-07':74C '-119735':13A,16A '-13':75C '-2026':12A,15A '/purchase-inquiry/thread':103C '2026':73C 'achiev':136C 'affect':134C 'allow':85C 'anoth':129C 'anyon':64B 'assign':109C 'attack':118C 'authent':86C 'browser':62B,127C 'clean':47B,116C 'complet':117C 'contain':76C 'cross':80C 'cross-sit':79C 'cve':11A,14A 'defac':143C 'descript':35B,94C 'execut':124C,138C 'full':141C 'full-pag':140C 'html':45B 'id':106C 'inject':6A,89C 'innerhtml':111C 'inquiri':9A,41B,101C 'item':34B,93C 'javascript':137C 'log':51B 'logged-in':50B 'malici':90C 'manag':26B 'markup':91C 'messag':37B,96C 'munshi':1A,17B,23B,69C 'open':66B,132C 'page':142C 'payload':122C 'petpooja':3A,19B,29B,71C 'product':27B 'purchas':8A,40B,100C 'raw':44B 're':146C 're-trigg':145C 'render':30B,113C 'reopen':152C 'restaur':21B,25B 'restaurant-softwar':20B 'run':59B 'script':5A,57B,82C 'site':81C 'softwar':22B 'store':4A,55B,78C,120C 'submit':33B,97C 'text':115C 'thread':10A,42B,68B,102C,105C,135C,150C 'thread-id':104C 'trigger':147C 'user':32B,53B,87C,130C 'user-submit':31B 'vulner':83C 'whenev':148C","nicknames":[],"mitigations":[],"who_affected":"Teams running Munshi by Petpooja before the 2026-07-13 release, particularly where several staff log in and use the Purchase Inquiry threads. Exposure depends on who can create content and who views the threads. The sources do not say which deployment models are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","munshi","other","petpooja","restaurantsoftware"],"first_public_at":"2026-11-02T19:18:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119735","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119735","severity":null,"published_at":"2026-11-02T19:18:02+00:00","modified_at":"2026-11-02T19:18:02+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","fetched_at":"2026-11-02T19:24:39+00:00","note":null}],"documents":[{"id":53466,"url":"https://www.vulncheck.com/advisories/munshi-xss-via-purchase-inquiry-thread-rendering","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}