---
id: "CVE-2026-126798"
page: "https://infrastack.ai/live/CVE-2026-126798"
kind: "vulnerability"
aliases: ["CVE-2026-126798"]
title: "NextScan: stored XSS in asset detail dialog steals admin session tokens"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "NextScan", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["nextscan", "other", "self-hosted"]
not_affected_if: ["outside-affected-versions"]
published_at: "2026-11-11T21:16:43+00:00"
first_seen_at: "2026-11-11T21:29:07+00:00"
updated_at: "2026-11-11T21:31:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126798", "first_seen_at": "2026-11-11T21:29:07+00:00"}]
exploit_sources: []
---

# NextScan: stored XSS in asset detail dialog steals admin session tokens

Link for people: https://infrastack.ai/live/CVE-2026-126798 (this .md is for agents)

NextScan 1.1.0 through 1.2.0 renders crawled form request bodies into the admin asset detail dialog using innerHTML without encoding. An attacker who hosts a crafted form on a crawled site can store JavaScript that runs when a user views the asset, reading localStorage access tokens and hijacking sessions, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NextScan affected range not listed fixed no fixed version listed

## How to check

- Check the installed NextScan version; versions `1.1.0` through `1.2.0` are described as affected.
- Review whether the ns-admin asset detail dialog is reachable by staff or administrators.

## Timeline

- 2026-11-11T21:29:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126798

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-stored-xss-via-url-asset-detail-view

## From the sources

NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_