CVE-2026-13083: Pen-drive: pen-drive: stored xss via unescaped cluster data in html report

Severity: medium (CVSS 6.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-26 · updated 2026-10-25
Weakness: CWE-79

Description

A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administrator privileges can inject a stored cross-site scripting (XSS) payload into cluster objects (such as ClusterVersion spec.channel) that executes in the browser of any user who opens the generated HTML report.

Affected products

Red Hat Pen Drive Powered by Red Hat Lightspeed: before 1.0.0-2 — fixed in 1.0.0-2

How to fix

Upgrade to a fixed version: Red Hat Pen Drive Powered by Red Hat Lightspeed 1.0.0-2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-13083 or the next vulnerability affects your stack