CVE-2026-41468

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41468", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-04-20T16:07:47.311Z", "datePublished": "2026-04-22T18:04:38.557Z", "dateUpdated": "2026-04-22T19:05:22.738Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-04-22T18:35:51.491Z"}, "title": "Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template Injection", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1104", "description": "CWE-1104 Use of Unmaintained Third-Party Components", "type": "CWE"}]}], "affected": [{"vendor": "Beghelli", "product": "SicuroWeb (Sicuro24)", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection present in the same application, these primitives allow attackers to escape the AngularJS sandbox and achieve arbitrary JavaScript execution in operator browser sessions, enabling session hijacking, DOM manipulation, and persistent browser compromise. Network-adjacent attackers can deliver the complete injection and escape chain via MITM in plaintext HTTP deployments without active user interaction.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection present in the same application, these primitives allow attackers to escape the AngularJS sandbox and achieve arbitrary JavaScript execution in operator browser sessions, enabling session hijacking, DOM manipulation, and persistent browser compromise. Network-adjacent attackers can deliver the complete injection and escape chain via MITM in plaintext HTTP deployments without active user interaction.<br>"}]}], "references": [{"url": "https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191/", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-POC.py", "tags": ["exploit"]}, {"url": "https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-SicuroWeb-ATI-chain.txt", "tags": ["technical-description"]}, {"url": "https://www.beghelli.it", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/beghelli-sicuro24-sicuroweb-angularjs-sandbox-escape-via-template-injection", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L"}}], "credits": [{"lang": "en", "value": "Jean-Marie Bourbon of Bourbon Offensive Security Services", "type": "finder"}, {"lang": "en", "value": "VulnCheck", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T19:04:44.514782Z", "id": "CVE-2026-41468", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T19:05:22.738Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41468", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-22T19:04:44.514782Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T19:04:51.055Z"}}], "cna": {"title": "Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template Injection", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Jean-Marie Bourbon of Bourbon Offensive Security Services"}, {"lang": "en", "type": "coordinator", "value": "VulnCheck"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Beghelli", "product": "SicuroWeb (Sicuro24)", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}], "references": [{"url": "https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191/", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-POC.py", "tags": ["exploit"]}, {"url": "https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-SicuroWeb-ATI-chain.txt", "tags": ["technical-description"]}, {"url": "https://www.beghelli.it", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/beghelli-sicuro24-sicuroweb-angularjs-sandbox-escape-via-template-injection", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection present in the same application, these primitives allow attackers to escape the AngularJS sandbox and achieve arbitrary JavaScript execution in operator browser sessions, enabling session hijacking, DOM manipulation, and persistent browser compromise. Network-adjacent attackers can deliver the complete injection and escape chain via MITM in plaintext HTTP deployments without active user interaction.", "supportingMedia": [{"type": "text/html", "value": "Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection present in the same application, these primitives allow attackers to escape the AngularJS sandbox and achieve arbitrary JavaScript execution in operator browser sessions, enabling session hijacking, DOM manipulation, and persistent browser compromise. Network-adjacent attackers can deliver the complete injection and escape chain via MITM in plaintext HTTP deployments without active user interaction.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1104", "description": "CWE-1104 Use of Unmaintained Third-Party Components"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-04-22T18:35:51.491Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41468", "state": "PUBLISHED", "dateUpdated": "2026-04-22T19:05:22.738Z", "dateReserved": "2026-04-20T16:07:47.311Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-04-22T18:04:38.557Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "SicuroWeb (Sicuro24)", "vendor": "Beghelli", "versions": [{"status": "affected", "version": "0"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection present in the same application, these primitives allow attackers to escape the AngularJS sandbox and achieve arbitrary JavaScript execution in operator browser sessions, enabling session hijacking, DOM manipulation, and persistent browser compromise. Network-adjacent attackers can deliver the complete injection and escape chain via MITM in plaintext HTTP deployments without active user interaction."}, {"lang": "es", "value": "Beghelli Sicuro24 SicuroWeb incorpora AngularJS 1.5.2, un componente al final de su vida \u00fatil que contiene primitivas de escape de sandbox conocidas. Cuando se combinan con la inyecci\u00f3n de plantillas presente en la misma aplicaci\u00f3n, estas primitivas permiten a los atacantes escapar del sandbox de AngularJS y lograr la ejecuci\u00f3n arbitraria de JavaScript en las sesiones del navegador del operador, lo que permite el secuestro de sesi\u00f3n, la manipulaci\u00f3n del DOM y el compromiso persistente del navegador. Los atacantes adyacentes a la red pueden entregar la cadena completa de inyecci\u00f3n y escape a trav\u00e9s de MitM en implementaciones HTTP de texto plano sin interacci\u00f3n activa del usuario."}], "id": "CVE-2026-41468", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 6.0, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41468", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T19:04:44.514782Z", "version": "2.0.3"}}]}, "published": "2026-04-22T19:17:08.813", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-POC.py"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-SicuroWeb-ATI-chain.txt"}, {"source": "disclosure@vulncheck.com", "url": "https://www.beghelli.it"}, {"source": "disclosure@vulncheck.com", "url": "https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/beghelli-sicuro24-sicuroweb-angularjs-sandbox-escape-via-template-injection"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1104"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SicuroWeb (Sicuro24)", "source": "cna", "vendor": "Beghelli"}, "product": "sicuroweb_(sicuro24)", "vendor": "beghelli"}], "analysis": {"en": {"generated_at": "2026-04-27T08:33:02.117997+00:00", "value": {"mitigation_remediation": ["Force deployment to use HTTPS/TLS to eliminate plaintext traffic and block MITM injection opportunities.", "Update or remove AngularJS 1.5.2, replacing it with a supported framework version or removing the component entirely.", "Implement strict input validation and sanitization to block template injection in client\u2011side code.", "Verify whether Beghelli releases a patch or advisory for this vulnerability, and apply it when available."], "summary": {"action": "Assess Impact", "impact": "Client-side RCE"}, "threat_synthesis": {"affected_systems": "The affected product is Beghelli SicuroWeb, part of the Sicuro24 suite, with vendor name Beghelli. No specific version numbers are provided in the advisory; the flaw resides in any installation that embeds AngularJS 1.5.2 within the application.", "description_and_impact": "The vulnerability arises from Beghelli Sicuro24 SicuroWeb's use of AngularJS 1.5.2, an end\u2011of\u2011life framework that includes known sandbox\u2011escape primitives. When an attacker is able to inject a malicious template into the application, these primitives enable escape from the AngularJS sandbox, allowing arbitrary JavaScript execution within the operator\u2019s browser session. The impact includes session hijacking, unauthorized DOM manipulation, and persistent compromise of the browser, effectively granting an attacker control over the client environment.", "risk_and_exploitability": "The CVSS score of 9.3 reflects critical confidentiality, integrity, and availability damage if exploited. Attackers need only an opportunistic position in the same physical or logical network to perform a man\u2011in\u2011the\u2011middle attack on plaintext HTTP traffic, which does not require user interaction. Because the vulnerability operates purely within the client browser, it bypasses server\u2011side defenses, and the exploitation chain is fully client\u2011side, leaving only the network posture and firewall controls as mitigations. The lack of an EPSS score and absence from the CISA KEV catalog do not reduce the threat; the known exploitation chain and ease of delivery make this vulnerability a pressing risk in exposed environments."}}}}, "created": "2026-04-27T18:42:00.089630+00:00", "updated": "2026-04-27T19:53:19.324594+00:00", "vendors": ["beghelli", "beghelli$PRODUCT$sicuroweb_(sicuro24)"]}