Description

NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-31T07:17:43.750Z",
  "pubdate": "2026-08-31T07:17:43.750Z",
  "executiveSummary": "The NSP workflow application is susceptible to a stored Cross-Site Scripting (XSS) vulnerability stemming from inadequate sanitization and encoding of user-supplied data.\nThis flaw enables an authenticated attacker to inject and persist malicious scripts within the application's data layer.\nWhen a victim, such as an administrator or another authorized user, views the compromised workflow content, the injected script executes within the context of their active browser session.\nThe impact includes unauthorized session hijacking, theft of sensitive authentication cookies, unauthorized actions performed on behalf of the victim, and potential exfiltration of proprietary workflow data.\nThe vulnerability is limited to authenticated users who possess sufficient permissions to interact with the application's workflow input fields.\nRisk implications are high for environments where user trust is implicit, as the persistence of the payload ensures ongoing exposure until the injected content is manually purged from the database.",
  "technicalDetails": "The root cause of this vulnerability is the improper handling of user-controlled input within the NSP workflow application. The application fails to perform rigorous input validation or context-aware output encoding before rendering user-provided data back to the browser.\nBy failing to sanitize input, the application permits the storage of arbitrary HTML or JavaScript tags in the underlying database.\nExploitation follows a specific attack vector: first, an authenticated attacker identifies a workflow input parameter that is reflected back to the user interface without sanitization. Second, the attacker crafts a malicious payload (e.g., <script>alert(document.cookie)</script> or an obfuscated remote script injection).\nThird, the attacker submits this payload through the workflow application's standard submission interface, causing the server to store the malicious code as legitimate application data.\nFinally, the payload is executed whenever a user navigates to the specific workflow view containing the injected content. Because the script executes within the victim's browser session, the browser treats the script as originating from the legitimate, trusted domain of the NSP application.\nThis bypasses Same-Origin Policy (SOP) restrictions, granting the attacker the ability to execute actions with the victim's privileges. If the victim has administrative access, the attacker may potentially achieve full account takeover or perform unauthorized administrative operations.\nThe vulnerability requires the attacker to have an active, authenticated session within the workflow application. It does not require specialized network access beyond reachability to the application's internal or external endpoint. The post-exploitation impact is limited only by the permissions of the targeted user, making it a critical threat to the integrity and confidentiality of the NSP workflow data."
}