{"id":"CVE-2026-18516","published":"2026-10-16T14:17:24.710","lastModified":"2026-10-16T20:04:29.760","description":"An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-116"],"vendors":[],"products":[],"references":[{"url":"https://gitlab.com/crafty-controller/crafty-4/-/work_items/743","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A stored XSS vulnerability exists in Crafty Controller's Audit Logs component that allows remote attackers to inject malicious scripts into HTTP headers, which can execute in the context of authenticated users' browsers when they view audit logs. This creates a critical risk for data exfiltration and session hijacking.","exploitability":"Exploitation is relatively straightforward requiring only HTTP header injection via the audit logging component, with no authentication required for initial payload delivery.","blast_radius":"If exploited, this vulnerability could allow attackers to steal user sessions, redirect victims to malicious sites, or execute arbitrary JavaScript in the context of affected users' browsers when viewing audit logs.","remediation":"Upgrade to Crafty Controller version 2.590 or later to address this stored XSS vulnerability in the Audit Logs component.","detection":"Monitor application logs for unusual HTTP header injection patterns in audit log entries, particularly those containing script tags or JavaScript payloads that appear in logged request headers.","tags":["xss","audit-logs","web","header-injection"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:47:54.372Z"}}