CVE-2026-19716

The vulnerability lives in a user management component where attacker-controlled usernames get interpolated into an onclick attribute on a deletion button. The developers called escapeHTML() on the username before inserting it, believing the escaping handled security. It didn't. The issue is that HTML attributes parse before JavaScript. When the browser renders the onclick attribute, it first interprets it as HTML and decodes HTML entities—so escapeHTML()'s conversion of ' to ' becomes ' again. This breaks the string literal open, and the injected JavaScript executes with the victim's session cookies attached to a destructive action (account deletion). The single quote is the most basic HTML entity; this isn't a clever bypass. What makes this severe is not generic script execution but the specific context: an authenticated admin viewing the user list triggers the payload passively. The victim clicks their own delete button—the one already in their workflow—to destroy another account, with their own session credentials. This is supply-chain injection through data-at-rest at the highest privilege level. The fix must go beyond swapping escapeHTML() for a JavaScript escaper. The durable solution is restructuring the event binding to avoid inline JavaScript entirely—using event delegation or data attributes with separate handlers. If inline onclick must persist, require a context-aware encoding function at the templating layer, not a generic HTML escaper. The pattern will recur if developers can reach for the wrong escaping function without the framework flagging it.

Reviewed through automated stages and approved by a human before publication.