By combining AI with human insight, Armis Vulnerability Intelligence Database offers extended coverage for vulnerabilities that matter to you, your industry, and provides you with clear remediation instructions.
Loading CVE list…
CVE Name
Severity Score
Published Date
CISA KEV
Take These Insights to the Next Level
Armis now offers direct API access to Armis Vulnerability Intelligence Database through the AWS Marketplace, transforming it from a powerful research tool into an integrated component of your proactive security posture.
Seamless Integration: Directly feed Armis's contextual data into your existing stack.
Automated Workflows: Automate vulnerability lookups in real-time.
Custom Solutions: Use the raw data to build custom dashboards, reports, alerts.
See everything.Identify true risk.Proactively mitigate threats.Book a Demo
Let's talk!
CVE-2023-26146:
Loading CVE details…
CVE-2023-26146 | Medium Severity | Armis
.txt\"), the application renders the filename as-is, causing the browser to interpret and execute the embedded JavaScript. This vulnerability can be exploited by attackers to steal cookies, session tokens, or other sensitive information, perform actions on behalf of the victim user, or redirect users to malicious websites.\n","datePublished":"2023-09-29T05:15:46.000Z","dateModified":"2026-05-13T09:04:52.902Z","keywords":"Medium, 2023, CVE, vulnerability, cybersecurity, CVSS","url":"https://cve.armis.com/CVE-2023-26146","author":{"@type":"Organization","name":"Armis","url":"https://www.armis.com"},"publisher":{"@type":"Organization","name":"Armis","url":"https://www.armis.com"},"license":"https://creativecommons.org/licenses/by-nc-sa/4.0/","isBasedOn":{"@type":"WebPage","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26146","name":"NVD CVE-2023-26146"},"additionalProperty":[{"@type":"PropertyValue","name":"CVSS Score","value":"6.1"},{"@type":"PropertyValue","name":"Severity","value":"Medium"},{"@type":"PropertyValue","name":"EPSS Score","value":"0.20%"},{"@type":"PropertyValue","name":"EPSS Percentile","value":"41th"},{"@type":"PropertyValue","name":"Attack Vector","value":"NETWORK"},{"@type":"PropertyValue","name":"Attack Complexity","value":"LOW"},{"@type":"PropertyValue","name":"Privileges Required","value":"NONE"},{"@type":"PropertyValue","name":"User Interaction","value":"REQUIRED"},{"@type":"PropertyValue","name":"Scope","value":"CHANGED"},{"@type":"PropertyValue","name":"Confidentiality Impact","value":"LOW"},{"@type":"PropertyValue","name":"Integrity Impact","value":"LOW"},{"@type":"PropertyValue","name":"Availability Impact","value":"NONE"}]},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is CVE-2023-26146?","acceptedAnswer":{"@type":"Answer","text":"Cross-site Scripting (XSS) vulnerability in ithewei/libhv allows attackers to inject malicious scripts through filenames.\n"}},{"@type":"Question","name":"How severe is CVE-2023-26146?","acceptedAnswer":{"@type":"Answer","text":"CVE-2023-26146 has a CVSS score of 6.1 (Medium severity). EPSS score: 0.20% (41th percentile), indicating the estimated probability of exploitation in the wild."}},{"@type":"Question","name":"How do I fix CVE-2023-26146?","acceptedAnswer":{"@type":"Answer","text":"To remediate this vulnerability:\n1. Update to a patched version of ithewei/libhv if available.\n2. If no patch is available, implement proper output encoding for filenames before displaying them in the web interface.\n3. Apply HTML entity encoding to user-controlled content, particularly filenames.\n4. Consider implementing Content Security Policy (CSP) headers to mitigate the impact of XSS attacks.\n5. Validate and sanitize filenames on both the server and client sides before processing or displaying them.\n6. Consider using a security library specifically designed to prevent XSS attacks when displaying user-controlled content.\n"}}]},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://cve.armis.com/"},{"@type":"ListItem","position":2,"name":"CVE-2023-26146","item":"https://cve.armis.com/CVE-2023-26146"}]}]
CVE-2023-26146:
Cross-site Scripting (XSS) vulnerability in ithewei/libhv allows attackers to inject malicious scripts through filenames.
Score
A numerical rating that indicates how dangerous this vulnerability is.
6.1Medium
Published Date:Sep 29, 2023
CISA KEV Date:*No Data*
Industries Affected:20
Threat Predictions
EPSS Score:0.2
EPSS Percentile:41%
Exploitability
Score:2.8
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:
REQUIRED
Scope:CHANGED
Impact
Score:2.7
Confidentiality Impact:LOW
Integrity Impact:LOW
Availability Impact:NONE
Description Preview
Cross-site Scripting (XSS) vulnerability in ithewei/libhv allows attackers to inject malicious scripts through filenames.
Overview
The ithewei/libhv library is vulnerable to Cross-site Scripting (XSS) attacks (CWE-79). The vulnerability occurs because the application fails to properly sanitize or encode filenames before displaying them in the web interface. When a user uploads or accesses a file with a specially crafted name containing JavaScript code (such as "alert(1).txt"), the application renders the filename as-is, causing the browser to interpret and execute the embedded JavaScript. This vulnerability can be exploited by attackers to steal cookies, session tokens, or other sensitive information, perform actions on behalf of the victim user, or redirect users to malicious websites.
Remediation
To remediate this vulnerability:
Update to a patched version of ithewei/libhv if available.
If no patch is available, implement proper output encoding for filenames before displaying them in the web interface.
Apply HTML entity encoding to user-controlled content, particularly filenames.
Consider implementing Content Security Policy (CSP) headers to mitigate the impact of XSS attacks.
Validate and sanitize filenames on both the server and client sides before processing or displaying them.
Consider using a security library specifically designed to prevent XSS attacks when displaying user-controlled content.
