CVE-2026-13083CWE-79

Pen-drive: pen-drive: stored xss via unescaped cluster data in html report

Medium · published June 25, 2026

CVSS v3.1
6.9
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administrator privileges can inject a stored cross-site scripting (XSS) payload into cluster objects (such as ClusterVersion spec.channel) that executes in the browser of any user who opens the generated HTML report.

The record
Technical detail
CVSS v3.1
6.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00303 · 21.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-25T23:23Z
EPSS history
Timeline
  • 25 JUN 23:23Z
    Pen-drive: pen-drive: stored xss via unescaped cluster data in html report
    cvelistv5