Medium

Hayabusa < 3.8.0 XSS via JSON Log Import

Type: advisorySources: OSV

Hayabusa versions prior to 3.8.0 contain a cross-site scripting (XSS) vulnerability in its HTML report output that allows an attacker to execute arbitrary JavaScript when a user scans JSON-exported logs containing malicious content in the Computer field. An attacker can inject JavaScript into the Computer field of JSON logs that executes in the forensic examiner's browser session when viewing the generated HTML report, leading to information disclosure or code execution.

Products: Not specified
Affected versions: Not specified
Fixed versions: Not specified
CVEs: CVE-2026-40028
Confirmed fixed CVEs: Not specified
Updated in this feed: 2 Nov 2026, 22:22 UTC · Revision 1

Source evidence

Hayabusa < 3.8.0 XSS via JSON Log Import

core-osv · Original source

Published 8 Apr 2026, 21:35 UTC

osv:CVE-2026-40028

Complete source record

{
  "id": "941384bb554cbb99df3b6caf54478be5aa0ad1afc9867fbd11af8fbdcf7c35d6",
  "url": "https://osv.dev/vulnerability/CVE-2026-40028",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Hayabusa < 3.8.0 XSS via JSON Log Import",
    "summary": "Hayabusa versions prior to 3.8.0 contain a cross-site scripting (XSS) vulnerability in its HTML report output that allows an attacker to execute arbitrary JavaScript when a user scans JSON-exported logs containing malicious content in the Computer field. An attacker can inject JavaScript into the Computer field of JSON logs that executes in the forensic examiner's browser session when viewing the generated HTML report, leading to information disclosure or code execution.",
    "evidence": "osv:CVE-2026-40028",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-40028",
      "aliases": [
        "CVE-2026-40028"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/yamato-security/hayabusa",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "00f8bcd574623b417e728f2f083a63ee82b7b077"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:yamato-security:hayabusa:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "3.8.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "00f8bcd574623b417e728f2f083a63ee82b7b077"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v3.8.0"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.7.0",
            "v3.6.0",
            "v3.5.0",
            "v3.4.0",
            "v3.3.0",
            "v3.2.0",
            "v3.1.1",
            "v3.1.0",
            "v3.0.1",
            "v3.0.0",
            "v2.19.0",
            "v2.18.0",
            "v2.17.0",
            "v2.16.1",
            "v2.16.0",
            "v2.15.0",
            "v2.14.0",
            "v2.13.0",
            "v2.12.0",
            "v2.11.0",
            "v2.10.1",
            "v2.10.0",
            "v2.9.0",
            "v2.8.0",
            "v2.7.0",
            "v2.6.0",
            "v2.5.1",
            "v2.5.0",
            "v2.4.0",
            "v2.3.3",
            "v2.3.2",
            "v2.3.1",
            "v2.3.0",
            "v2.2.2",
            "v2.2.0",
            "v2.1.0",
            "v1.9.0",
            "v2.0.0",
            "v1.8.1",
            "v1.8.0",
            "v1.7.2",
            "v1.7.1",
            "v1.7.0",
            "v1.6.0",
            "v1.5.1",
            "v1.5.0",
            "v1.4.3",
            "v1.4.2",
            "v1.4.1",
            "v1.4.0",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.0",
            "v1.0.0-R2",
            "v1.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40028.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:24.121671409Z",
      "provider": "osv",
      "references": [
        "https://github.com/Yamato-Security/hayabusa/releases/tag/v3.8.0",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40028.json",
        "https://mobasi.ai/sentinel",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-40028",
        "https://www.vulncheck.com/advisories/hayabusa-xss-via-json-log-import"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-79"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40028.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-40028",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 490529,
  "published_at": "2026-04-08T21:35:24.001+00:00"
}