CVE-2026-49864: wetty vulnerable to DOM XSS via file-download filename

July 1, 2026

The wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (escapeMarkup: false). Any output the victim renders - a cat’d file, a tailed log, an SSH MOTD, a curl response - that contains \x1b[5i...:...\x1b[4i runs script in the wetty origin and types attacker-chosen keystrokes into the victim’s SSH session.

References

github.com/advisories/GHSA-p26j-h7wj-r568
github.com/butlerx/wetty/security/advisories/GHSA-p26j-h7wj-r568
nvd.nist.gov/vuln/detail/CVE-2026-49864

Code Behaviors & Features

Detect and mitigate CVE-2026-49864 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →