Executive brief
A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution in github.com/pinchtab/pinchtab
Affected products
- Go github.com/pinchtab/pinchtab
- Go github.com/pinchtab/pinchtab/cmd/pinchtab
Junglewise Threat Intelligence
CVE-2026-33622: GO-2026-4824 - A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution in github.com/pinchtab/pinchtab
CVE-2026-33622 · Severity: medium · CVSS 4 · Published 2026-03-26
Technologies: github.com/pinchtab/pinchtab (Go), github.com/pinchtab/pinchtab/cmd/pinchtab (Go). Vendors: Go.
Related threats
- GO-2026-4823 - PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution in github.com/pinchtab/pincht
- GO-2026-4822 - PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems in github.com/pinchtab/pinchtab
- GO-2026-4821 - PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token in github.com/pinchtab/pinchtab
- PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl
- GO-2026-4748 - PinchTab has a Blind SSRF via browser-side redirect bypass in /download URL validation in github.com/pinchtab/pinchtab