Live › vulnerability › CVE-2026-119764
Mythic, a command-and-control framework, has a stored cross-site scripting flaw in versions 3.2.16 through 3.4.0.61. An attacker who controls files on a target endpoint can plant HTML disguised as a PDF, and when an operator clicks Preview Media the script runs in the Mythic UI and reads localStorage JWTs, giving full GraphQL and REST access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Teams running Mythic in the affected version range, where operators preview media collected from target endpoints. The flaw needs an attacker-controlled file to reach an operator's preview, so teams on versions outside the range can skip it. The sources do not say which versions are patched.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Mythic | other | >= 3.2.16, <= 3.4.0.61 | – |
3.2.16 through 3.4.0.61Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.
This page as .md · .json · in your agent: get_signal("CVE-2026-119764")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.