Executive brief
Yaffa, a personal finance web application, is vulnerable to a security flaw that allows attackers to inject malicious scripts into the platform. By using the 'Add Account Group' feature, an attacker can store a script that executes in the browser of any user who later views that page. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in yaffa version 2.0.0 and earlier. The vulnerability is located in the 'Add Account Group' function on the account-group page, where user-supplied input is improperly neutralized before being rendered in the web interface (CWE-79). An attacker can exploit this by submitting malicious JavaScript as part of an account group name or description. When other users, including administrators, navigate to the affected page, the script executes within their browser session. This can result in session hijacking, unauthorized data modification, or redirection to malicious sites. As of the advisory date, no patched version has been identified.
Affected products
- kantorge yaffa <= 2.0.0
Timeline
- 2026-02-01: other: Vulnerability discovered by J4cky1028
- 2026-04-07: disclosed: CVE-2025-70844 published by NVD
- 2026-04-07: advisory: GitHub Advisory GHSA-pq95-94c9-j987 published