CVE-2026-66824

This vulnerability stems from using Jinja's `|safe` filter to embed JSON data directly into an inline `<script>` block within a capture tree visualization template. The developer likely made a conscious choice—auto-escaped output was breaking their JavaScript context, and `|safe` was the immediate, ergonomic solution. The filter is documented, intentional, and right there in the framework. It works. That's the problem: the insecure pattern is the path of least resistance. The fix (moving to a dedicated API endpoint) is architecturally superior, but it requires genuine additional work—new route handler, error handling, client-side async logic. Meanwhile, `|safe` is one line. This is a structural incentive problem, not developer laziness. The secure pattern should be the frictionless pattern, and until frameworks provide first-class support for the dedicated-API pattern at the same ergonomic cost as inline embedding, the same mutation will recur in future features. What makes this instance catastrophically worse than the CVSS suggests: the victim is an analyst viewing a capture tree—someone who has been collecting network traffic that may include credentials, API keys, PII, or session tokens from other users. Compromising this user doesn't give a low-privilege foothold; it gives access to everything they've captured. This is a high-value target with blast radius that the generic CVSS calculation underweights. After patching, don't just verify the dedicated endpoint works—audit every `|safe` call in the same template family. Whoever reached for `|safe` here was likely operating under a mental model ('the escaping is blocking me, I'll opt out') that exists in other templates waiting for the next friction point to reactivate. This specific mutation—inline JSON via `|safe` in data-aggregation visualization—has ancestors (similar patterns appeared in prior Flask/Django CVEs). The knowledge exists; the failure is synthesis—connecting the pattern at commit time before it ships.

Reviewed through automated stages and approved by a human before publication.