Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-61728— SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover

Quick assessment

Affected

socfortress CoPilot

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SOCFortress CoPilot 旨在为所有安全运营需求提供统一的可视化管理界面。在受影响的快照版本中（即针对 0.1.70 和 0.1.76 版本修复漏洞之前的版本），门户用户（包括）可通过接口提交持久化存储的标记内容。在文件中，虽替换了中的换行符，但随后将结果直接传递给指令，而未对 HTML 进行转义或清洗。当其他用户查看被污染的警报时，存储型脚本将在应用程序的源域上执行。同样的未清洗渲染模式也影响了服务器端存储的 SOC 工单、资产及健康检查字段，涉及组件包括、、、和。此外，位于

CVSS 9.9 · Critical Updated Oct 30, 2026

Possible ATT&CK Techniques 3 AI

T1538.002 T1055.001 · Dynamic-link Library Injection T1193.001

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover

Source: CVE Program / CVE List V5

Vulnerability Description

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including `customer_user`, can submit stored markup through `POST /api/incidents/db_operations/alert/comment`. In `customer-portal/src/components/alerts/AlertDetails/AlertComment.vue`, `commentHtml` replaces newlines in `comment.comment` but passes the result to `v-html` without escaping or sanitizing HTML. When another user views the poisoned alert, stored script executes on the application origin; the same unsanitized rendering pattern affects server-stored SOC case, asset and health-check fields in `SocCaseNote.vue`, `SocCaseItem.vue`, `SocCaseAssetsItem.vue`, `SocAlertAssetsItem.vue` and `HealthcheckItem.vue`. The authentication store in `customer-portal/src/stores/auth.ts` persists both access and refresh tokens in JavaScript-readable storage, and `customer-portal/src/api/httpClient.ts` uses bearer headers rather than HttpOnly cookies. An injected script can steal both tokens, impersonate the viewer and obtain fresh tokens through `/auth/refresh`. If an analyst or administrator views the poisoned alert or case, this enables persistent privileged account takeover, cross-tenant data access, incident modification or deletion, and detection/response subversion. The health-check sink repair is first contained in version 0.1.70, while the comment and other SOC sink repairs are first contained in version 0.1.76. Version 0.1.76 is the provisional first release containing all observed repairs; grouped versus split CVE scope requires curator adjudication.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
socfortress	CoPilot	< 0.1.76	-

II. Public POCs for CVE-2026-61728

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-61728

请登录查看更多情报信息。

Vendor Pages for CVE-2026-61728 (1)

🔗 GitHub - socfortress/CoPilot at v0.1.76 · GitHub x_refsource_MISC

Other References for CVE-2026-61728 (5)

https://github.com/socfortress/CoPilot/pull/904 x_refsource_MISC
https://github.com/socfortress/CoPilot/pull/938 x_refsource_MISC
https://github.com/socfortress/CoPilot/security/advisories/GHSA-8hqj-cqcc-5f6w x_refsource_CONFIRM
https://github.com/socfortress/CoPilot/commit/461e8f84794aee8ada588de3bad79430dc9f4f3d x_refsource_MISC
https://github.com/socfortress/CoPilot/commit/ab9078bdee5d1c737f37f481103984665a670bdd x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-61728

Same Patch Batch · socfortress · 2026-10-30 · 6 CVEs total

CVE-2026-61738	10.0 CRITICAL	SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuit
CVE-2026-61729	9.4 CRITICAL	SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Inv
CVE-2026-61730	9.3 CRITICAL	SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Servi
CVE-2026-61708	8.5 HIGH	SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload E
CVE-2026-61739	7.5 HIGH	SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma

IV. Related Vulnerabilities

Same product: CoPilot

Same vendor: socfortress

Same weakness: CWE-79