{"id":"CVE-2026-126798","kind":"vulnerability","aliases":["CVE-2026-126798"],"related":[],"title":"NextScan: stored XSS in asset detail dialog steals admin session tokens","description":"NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.","summary":"NextScan 1.1.0 through 1.2.0 renders crawled form request bodies into the admin asset detail dialog using innerHTML without encoding. An attacker who hosts a crafted form on a crawled site can store JavaScript that runs when a user views the asset, reading localStorage access tokens and hijacking sessions, including administrators.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NextScan","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["nextscan","other","self-hosted"],"not_affected_if":["outside-affected-versions"],"how_to_check":"- Check the installed NextScan version; versions `1.1.0` through `1.2.0` are described as affected.\n- Review whether the ns-admin asset detail dialog is reachable by staff or administrators.","fix":null,"status":"open","published_at":"2026-11-11T21:16:43+00:00","first_seen_at":"2026-11-11T21:29:07+00:00","triaged_at":"2026-11-11T21:31:00+00:00","updated_at":"2026-11-11T21:31:00+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T21:31:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"NextScan: stored XSS in asset detail dialog steals admin session tokens","impact":"high","summary":"NextScan 1.1.0 through 1.2.0 renders crawled form request bodies into the admin asset detail dialog using innerHTML without encoding. An attacker who hosts a crafted form on a crawled site can store JavaScript that runs when a user views the asset, reading localStorage access tokens and hijacking sessions, including administrators.","audience":"businesses","category":"other","nicknames":[],"who_cares":["nextscan","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Administrator session tokens stolen, leading to account takeover.","analyst_note":"Confirm the fixed version and whether the vendor has released a patch; the sources only give the affected range. See the vulncheck advisory linked in the source list.","how_to_check":"- Check the installed NextScan version; versions `1.1.0` through `1.2.0` are described as affected.\n- Review whether the ns-admin asset detail dialog is reachable by staff or administrators.","plain_action":"","product_name":"NextScan","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"who_is_affected":"Teams running NextScan 1.1.0 through 1.2.0 whose admin users open asset detail views for URLs the crawler has scanned. Exposure depends on whether the crawler reaches sites an attacker can control, since the payload is stored in crawled form data. Deployments outside that version range are not described as affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000766,"input_tokens":4629,"output_tokens":607,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126798':14A,17A '-2026':13A,16A '1.1.0':25B,75C '1.2.0':27B,77C 'access':67B,126C 'admin':9A,35B,90C 'administr':73B,132C 'asset':5A,36B,64B,92C,122C 'asset_url.data':101C 'attack':44B,106C 'bodi':32B,100C 'contain':78C 'craft':48B,109C 'crawl':29B,52B,97C,112C 'cross':82C 'cross-sit':81C 'cve':12A,15A 'detail':6A,37B,93C,123C 'dialog':7A,38B,94C 'encod':42B,105C 'execut':118C 'form':30B,49B,98C,110C 'hijack':70B,129C 'host':23B,46B,108C 'includ':72B,131C 'innerhtml':40B,103C 'javascript':56B,116C 'localstorag':66B,125C 'nextscan':1A,18A,19B,24B,74C 'ns':89C 'ns-admin':88C 'read':65B 'render':28B,96C 'request':31B,99C 'run':58B 'script':84C 'self':22B 'self-host':21B 'session':10A,71B,130C 'site':53B,83C,113C 'steal':8A,124C 'store':2A,55B,80C,115C 'token':11A,68B,127C 'url':91C 'use':39B 'user':61B,120C 'via':102C 'view':62B,121C 'vulner':85C 'without':41B,104C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Teams running NextScan 1.1.0 through 1.2.0 whose admin users open asset detail views for URLs the crawler has scanned. Exposure depends on whether the crawler reaches sites an attacker can control, since the payload is stored in crawled form data. Deployments outside that version range are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["nextscan"],"ptokens":["nextscan"],"labels":["medium","nextscan","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126798':14A,17A '-2026':13A,16A 'admin':9A 'asset':5A 'cve':12A,15A 'detail':6A 'dialog':7A 'nextscan':1A,18A 'session':10A 'steal':8A 'store':2A 'token':11A 'xss':3A","search_b":"'1.1.0':25B '1.2.0':27B 'access':67B 'admin':35B 'administr':73B 'asset':36B,64B 'attack':44B 'bodi':32B 'craft':48B 'crawl':29B,52B 'detail':37B 'dialog':38B 'encod':42B 'form':30B,49B 'hijack':70B 'host':23B,46B 'includ':72B 'innerhtml':40B 'javascript':56B 'localstorag':66B 'nextscan':19B,24B 'read':65B 'render':28B 'request':31B 'run':58B 'self':22B 'self-host':21B 'session':71B 'site':53B 'store':55B 'token':68B 'use':39B 'user':61B 'view':62B 'without':41B","search_c":"'1.1.0':75C '1.2.0':77C 'access':126C 'admin':90C 'administr':132C 'asset':92C,122C 'asset_url.data':101C 'attack':106C 'bodi':100C 'contain':78C 'craft':109C 'crawl':97C,112C 'cross':82C 'cross-sit':81C 'detail':93C,123C 'dialog':94C 'encod':105C 'execut':118C 'form':98C,110C 'hijack':129C 'host':108C 'includ':131C 'innerhtml':103C 'javascript':116C 'localstorag':125C 'nextscan':74C 'ns':89C 'ns-admin':88C 'render':96C 'request':99C 'script':84C 'session':130C 'site':83C,113C 'steal':124C 'store':80C,115C 'token':127C 'url':91C 'user':120C 'via':102C 'view':121C 'vulner':85C 'without':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T21:16:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126798","severity":null,"published_at":"2026-11-11T21:16:43+00:00","modified_at":"2026-11-11T21:16:43+00:00","first_seen_at":"2026-11-11T21:29:07+00:00","fetched_at":"2026-11-11T21:29:07+00:00","note":null}],"documents":[{"id":128958,"url":"https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-stored-xss-via-url-asset-detail-view","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}