CVE-2023-26445

Summary

CVE-2023-26445 is a vulnerability that allows an attacker to point frontend themes to malicious resources through user-controllable jslob settings. If exploited, attackers can execute malicious script code within the victim's context, leading to session hijacking or unwanted actions via the web interface and API. To exploit this vulnerability, an attacker would require temporary access to the user's account or lure a user to a compromised account. The vulnerability has been mitigated by sanitizing theme values and using a default fallback if no theme matches. No publicly available exploits are known at this time.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.