CVE-2026-23840 — AI Deep Analysis Summary

🚨 **Essence**: A Cross-Site Scripting (XSS) flaw in **Movary**. <br>💥 **Consequences**: Attackers can inject malicious scripts. This leads to **session hijacking**, **data theft**, or **defacement**.…

🛡️ **Root Cause**: **CWE-20** (Improper Input Validation). <br>❌ **Flaw**: The application fails to properly sanitize the `categoryDeleted` parameter. Untrusted input is rendered directly into the DOM without escaping.

📦 **Affected**: **Movary** by **leepeuker**. <br>📉 **Version**: All versions **prior to 0.70.0**. <br>🔧 **Component**: Specifically the `settings-account-location.js` script logic.

🕵️ **Attacker Actions**: <br>1. Steal **user cookies** (session tokens). <br>2. Perform **actions on behalf of the user**. <br>3. Redirect users to **malicious sites**. <br>4. Deface the **user interface**.

⚖️ **Threshold**: **Low** (CVSS:3.1). <br>🔑 **Auth**: **None required** (PR:N). <br>👀 **UI**: **User Interaction** required (UI:R). <br>🌐 **Network**: **Remote** (AV:N).…

💣 **Public Exploit**: **No** public PoC found in data. <br>📜 **References**: GitHub Advisory (GHSA-pj3m-gmq8-2r57) confirms the issue. <br>🔍 **Status**: Theoretical risk until a PoC is released.…

🔍 **Self-Check**: <br>1. Check your **Movary version**. <br>2. Inspect network requests for `categoryDeleted`. <br>3. Look for **unescaped HTML** in the `settings-account-location.js` output. <br>4.…

✅ **Fixed**: **Yes**. <br>📅 **Patch**: Version **0.70.0** resolves this. <br>🔗 **Source**: [GitHub Release 0.70.0](https://github.com/leepeuker/movary/releases/tag/0.70.0).…

🚧 **No Patch Workaround**: <br>1. **Disable** the affected feature if possible. <br>2. Implement **Input Validation** on the server side for `categoryDeleted`. <br>3.…

🔥 **Urgency**: **High**. <br>📊 **CVSS Score**: **7.5** (High). <br>⚡ **Priority**: **P1/P2**. <br>🚀 **Reason**: Remote, no auth required, and impacts confidentiality/integrity. Fix it **now** to prevent user compromise.