CVE-2026-79720 - Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution

Back Back to CVE browser

MEDIUM

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution

Published Aug 27, 2026

6.8

MEDIUM

CVSS 4.0

EPSS 0.26%

Description

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.

Affected products

Vendor Netron Product Netron Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <=9.1.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Netron

unaffected

Version	Status	Constraints
-	affected	<=9.1.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://github.com/lutzroeder/netron/commit/cd14bad8c9132b1aaf1d197fe61925575f194f00
Patch
https://www.hiddenlayer.com/sai-security-advisory/2026-08-netron
exploitVendor Advisory

Link	Providers	Tags
https://github.com/lutzroeder/netron/commit/cd14bad8c9132b1aaf1d197fe61925575f194f00		Patch
https://www.hiddenlayer.com/sai-security-advisory/2026-08-netron		exploitVendor Advisory