High · published January 28, 2026
⚡ Authenticated users can inject arbitrary HTML with ease! In Tactical RMM v1.3.1 and earlier, a simple POST request holds the key to chaos. 🔥 Think of it like an 'open mic' night at a comedy club, where anyone can grab the mic and share anything they want — even if it’s wildly inappropriate. This vulnerability allows users to take over the stage and deliver harmful content that could mislead or manipulate others. An attacker could exploit this to alter the management panel's appearance, tricking administrators into entering sensitive information or performing actions they didn’t intend to. This could lead to devastating client-side attacks, such as phishing, where unsuspecting users could be lured into malicious traps. Yikes!
Think of it like an 'open mic' night at a comedy club, where anyone can grab the mic and share anything they want — even if it’s wildly inappropriate. This vulnerability allows users to take over the stage and deliver harmful content that could mislead or manipulate others. This HTML injection vulnerability arises because the agent_id parameter in the POST /api/v3/newagent/ endpoint lacks proper sanitization when HTML is allowed. DOMPurify.sanitize() is misconfigured, allowing harmful HTML to be rendered unintentionally in the management panel.
An attacker could exploit this to alter the management panel's appearance, tricking administrators into entering sensitive information or performing actions they didn’t intend to. This could lead to devastating client-side attacks, such as phishing, where unsuspecting users could be lured into malicious traps. Yikes! To secure your system, upgrade to Tactical RMM v1.3.2 or later, where the vulnerability is patched. It’s also crucial to review and restrict the use of HTML in user inputs to mitigate future risks. Don’t forget to test thoroughly before deploying! You've got this! Implement these steps, and you’ll be back to superhero status in no time! 🛡️