CVE-2026-63355

Cross‑Site Scripting via Unsanitized Signal Names in Imported CSV Trace Files

Published Oct 13, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page.

This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the user subsequently interacts with an affected selection menu.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Title Cross‑Site Scripting via Unsanitized Signal Names in Imported CSV Trace Files
Type Values Removed Values Added
Description Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the user subsequently interacts with an affected selection menu.
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
siemens
Published
Updated
Oct 13, 2026, 12:57 PM
Reserved
Jul 16, 2026, 2:30 PM
Status
Awaiting Analysis
Published
Oct 13, 2026, 10:17 AM
Modified
Oct 15, 2026, 8:38 PM