Executive brief
Hayabusa is a digital forensics tool used by security professionals to analyze Windows event logs. A vulnerability in the tool's HTML reporting feature allows an attacker to embed malicious scripts into log files. If a forensic examiner scans these compromised logs and views the resulting report, the attacker's script could execute in their browser, potentially leading to the theft of sensitive investigation data or unauthorized access to the examiner's session.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Hayabusa's HTML report generation component. The root cause is improper neutralization of input within the 'Computer' field when the tool scans JSON-exported logs (as opposed to standard .evtx files). An attacker can inject arbitrary JavaScript into this field; when a forensic examiner generates and views an HTML report from these logs, the script executes within the context of the examiner's browser. This can lead to information disclosure or session hijacking. The vulnerability is fixed in version 3.8.0.
Affected products
- Yamato-Security Hayabusa < 3.8.0
Timeline
- 2026-01-31: patched: Version 3.8.0 released with fix.
- 2026-04-08: disclosed: Initial vulnerability disclosure.