# CVE-2026-126798: NextScan stored cross-site scripting in asset detail dialog

Source: https://junglewise.ai/threats/cve-2026-126798-nextscan-1-1-0-through-1-2-0-contains-a-stored-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126798 · Severity: medium · CVSS 4.7 · Published 2026-11-11

NextScan is a web asset discovery and crawling tool used by security teams to identify and catalog websites and their content. Versions 1.1.0 through 1.2.0 contain a stored cross-site scripting vulnerability in the admin panel where malicious JavaScript embedded in crawled web forms executes when administrators view asset details. An attacker can hijack administrator sessions and steal authentication tokens, gaining full control of the NextScan system and the reconnaissance data it contains.

Technologies: [Tongcheng-Security-Team NextScan](https://junglewise.ai/threats/technologies/nextscan). Vendors: [Tongcheng-Security-Team](https://junglewise.ai/threats/vendors/tongcheng-security-team).

## Quick answers

**Is CVE-2026-126798 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126798 being exploited in the wild.

**How severe is CVE-2026-126798?** Medium severity, with a CVSS score of 4.7, published 11 November 2026.

**Which products and versions are affected?** Tongcheng-Security-Team NextScan 1.1.0 through 1.2.0.

**Is there a fix for CVE-2026-126798?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-126798 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-126798?** Check whether you run Tongcheng-Security-Team NextScan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the ns-admin URL asset detail dialog, which renders crawled form request bodies (Asset_URL.data) via innerHTML without proper HTML encoding. An attacker can host crafted HTML forms on crawled websites; when the scanner processes these forms, the malicious JavaScript is stored in the database. When administrators view the asset details, the unencoded innerHTML renders the stored XSS payload, allowing theft of localStorage-stored access tokens and session hijacking. The attack requires the target site to be crawled by NextScan but no authentication or special privileges to host the malicious form.

## Affected products

- tongcheng-security-team NextScan 1.1.0 through 1.2.0

## Timeline

- 2026-11-07: disclosed
- 2026-11-11: advisory

## References

- [https://github.com/tongcheng-security-team/NextScan/issues/49](https://github.com/tongcheng-security-team/NextScan/issues/49)
- [https://hub.docker.com/r/lysec/ns-admin](https://hub.docker.com/r/lysec/ns-admin)

## Related threats

- [NextScan hardcoded HTTP Basic Auth credentials in agent routers](https://junglewise.ai/threats/cve-2026-126802-nextscan-1-1-0-through-1-2-0-contains-hardcoded-http-basic-auth)
- [NextScan authentication bypass in ns-admin via hardcoded JWT key](https://junglewise.ai/threats/cve-2026-126797-nextscan-1-1-0-through-1-2-0-contains-an-authentication-bypass)