NEXTSCAN · CVE-2026-126798 · Other
NO FIX YET
NextScan 1.1.0 through 1.2.0 renders crawled form request bodies into the admin asset detail dialog using innerHTML without encoding. An attacker who hosts a crafted form on a crawled site can store JavaScript that runs when a user views the asset, reading localStorage access tokens and hijacking sessions, including administrators.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running NextScan 1.1.0 through 1.2.0 whose admin users open asset detail views for URLs the crawler has scanned. Exposure depends on whether the crawler reaches sites an attacker can control, since the payload is stored in crawled form data. Deployments outside that version range are not described as affected.
Not affected if outside-affected-versions
Who cares nextscan, self-hosted
1.1.0 through 1.2.0 are described as affected.No fix yet, per the sources.
NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.