Vulnerability · Published Jun 25, 2026 · Assigned by redhat

CVE-2026-13083Pen-drive: pen-drive: stored xss via unescaped cluster data in html report

Medium 6.9

In plain English

A medium-severity cross-site scripting in Pen Drive Powered by Red Hat Lightspeed from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)6.9Medium

Exploit odds (30 days)0.3%top 76.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administrator privileges can inject a stored cross-site scripting (XSS) payload into cluster objects (such as ClusterVersion spec.channel) that executes in the browser of any user who opens the generated HTML report.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Pen Drive Powered by Red Hat Lightspeed	see references
Red Hat	Pen Drive Powered by Red Hat Lightspeed	see references

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2026-13083 vdb-entry, x_refsource_REDHAT
RHBZ#2491886 issue-tracking, x_refsource_REDHAT