CVE-2026-40028

OVERVIEW Hayabusa versions before 3.8.0 contain a stored cross-site scripting (XSS) vulnerability in HTML report generation functionality. The vulnerability exists in the Computer field of JSON-exported logs, allowing threat actors to inject malicious JavaScript that executes when forensic examiners view the generated HTML reports. SEVERITY The vulnerability carries a CVSS 3.1 score of 5.4 (Medium) with network-based attack vector and low attack complexity. While exploitation requires prior authentication and user interaction, the cross-site nature of the attack can affect multiple security domains. Potential impacts include information disclosure and limited code execution within the user's browser session during report analysis. EXPLOITATION STATUS There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains on the inactive Hot List. The EPSS score of 0.00031 indicates significantly lower probability of exploitation compared to typical vulnerabilities, suggesting limited community attention and no publicly available exploit code at this time.