CVE-2026-63355CWE-79cross-site-scripting
CVE-2026-63355
Medium · published October 13, 2026
What it is
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the user subsequently interacts with an affected selection menu.
The record
Technical detail
- CVSS v3.1
- 6.1 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v4.0
- 5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
- EPSS
- 0.00253 · 15.8th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2026-10-13T14:17Z
References (1)
EPSS history
Timeline
15 OCT 03:33Z
EPSS moved — → 0%
epss
13 OCT 09:18Z
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page
cvelistv5
13 OCT 09:18Z
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page
cvelistv5