CVE-2026-5026

CVE-2026-5026 is a stored Cross-Site Scripting (XSS) vulnerability found in an unspecified product, where an API endpoint serves SVG files without sanitizing their content. An attacker can upload malicious SVG files containing embedded JavaScript, which then executes when viewed by other users. This allows for the potential theft of authentication tokens, such as JWT access and refresh tokens, resulting in a CVSS score of 7.0 (HIGH) due to its network attack vector and high confidentiality impact. There is currently no evidence of active exploitation, nor are public exploit codes or significant community discussion available for this vulnerability.