CVE-2026-50883: An HTML injection vulnerability in the /src/highlight

Synopsis

An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to inject and execute arbitrary scripts in the context of a victim's browser session. The flaw is reachable over the network, requires no authentication, and is triggered when a victim interacts with attacker-controlled content (a classic cross-site scripting delivery path). Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected scope, including data exposure, content tampering, and service disruption. HarborGuard is tracking this advisory for patch availability, as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, meaning an attacker must be able to reach the service via standard network connectivity to deliver a crafted payload.

• AuthenticationNot required

  No credentials or account are needed; an unauthenticated attacker can submit a crafted payload directly to the affected endpoint.

• Victim interactionRequired

  A victim must interact with attacker-controlled content (for example, by opening or viewing a crafted paste link) for the injected script to execute in their browser session.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental factors beyond delivering the payload.

Blast Radius

• Reads session tokens, cookies, and any sensitive data accessible in the victim's browser context for the affected origin.
• Modifies page content rendered to the victim, enabling credential harvesting or redirection to attacker-controlled resources.
• Executes arbitrary scripts within the victim's authenticated session, allowing actions to be performed on the victim's behalf.
• Disrupts the victim's use of the affected service by injecting content that breaks normal page rendering or functionality.