Executive brief
PrivateBin is a web application for sharing encrypted pastes and files. A stored cross-site scripting (XSS) vulnerability allows an attacker to create a malicious paste with an HTML attachment that executes JavaScript in the victim's browser with full access to the instance's origin (cookies, localStorage, and ability to make authenticated requests). The attack requires the victim to click "Open in new tab" on the download link and only affects instances with file upload enabled and non-default security settings.
Technical details
The vulnerability is a stored XSS in PrivateBin's attachment handling, specifically in the `AttachmentViewer.setAttachment` function in `js/privatebin.js`. The root causes are: (1) DOMPurify sanitization only applies to SVG MIME types (`/^image\/.*svg/i`), allowing other HTML-like types (text/html, application/xhtml+xml, text/xml) to bypass sanitization; (2) the download link's href is set to an unsanitized blob URL before sanitization is applied, and the sanitization branch only updates a local variable consumed by the preview; (3) the MIME type is fully attacker-controlled, extracted from the encrypted payload that only the client can decrypt. An attacker creates a paste with an HTML attachment; when the victim opens the download link in a new tab, the browser renders the blob as a same-origin HTML document in the PrivateBin instance's origin, executing injected JavaScript. This is an incomplete fix of CVE-2022-24833. Exploitation requires: fileupload enabled (non-default), a weakened CSP (not the recommended default), and user interaction (opening the link in a new tab). The fix involves overwriting dangerous MIME types with `application/octet-stream` for downloads, forcing browser downloads instead of inline rendering.
Affected products
- PrivateBin PrivateBin <= 2.0.4
Timeline
- 2026-06-11: disclosed: Vulnerability reported via GitHub Security Advisory
- 2026-06-13: other: Vulnerability reproduced and patch development started
- 2026-06-14: other: Patch reviewed
- 2026-06-15: patched: Patch merged into repository (estimated from timeline)
- 2026-08-28: other: Vulnerability details published
References
- https://api.github.com/users/EvidentObscurity
- https://github.com/EvidentObscurity
- https://api.github.com/users/EvidentObscurity/gists%7B/gist_id%7D
- https://api.github.com/users/EvidentObscurity/repos
- https://avatars.githubusercontent.com/u/16970217?v=4
- https://api.github.com/users/EvidentObscurity/events%7B/privacy%7D