CVE-2026-59802
CVE-2026-59802 is a high-severity vulnerability with a CVSS 3.x base score of 8.2. The underlying weakness is classified as CWE-183.
Key facts
- Severity: High (CVSS 3.x base score 8.2)
- CVSS v4: 6.3
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-183
- Published:
- Last modified:
Description
PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malicious pushes containing data:text/html URIs that execute arbitrary JavaScript in victims' browsers when clicked, enabling phishing and credential theft under the trusted PasswordPusher domain.
Frequently asked questions
- What is CVE-2026-59802?
- PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malicious pushes containing data:text/html URIs that execute arbitrary JavaScript in victims' browsers when clicked, enabling phishing and credential theft under the trusted PasswordPusher domain.
- How severe is CVE-2026-59802?
- CVE-2026-59802 has a CVSS 3.x base score of 8.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity low, and availability none.
- Is CVE-2026-59802 being actively exploited?
- It is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS exploit-prediction score is available yet.
- How do I fix CVE-2026-59802?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-59802 published?
- CVE-2026-59802 was published on 2026-07-08.
References
- https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-76c2-66pg-fj2f
- https://www.vulncheck.com/advisories/passwordpusher-redirect-based-xss-via-data-uri-in-url-push-payload
Other CWE-183 vulnerabilities
- CVE-2026-3490 — Critical (CVSS 10.0): picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by…
- CVE-2026-54316 — Critical (CVSS 9.1): Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved…
- CVE-2026-29514 — High (CVSS 8.8): NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the…
- CVE-2026-46391 — High (CVSS 8.7): HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version…
- CVE-2025-53762 — High (CVSS 8.7): Permissive list of allowed inputs in Microsoft Purview allows an authorized attacker to elevate privileges over a…
- CVE-2026-41387 — High (CVSS 7.8): OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in…