The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
CVE-2026-61728: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-61728
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
SOCFortress CoPilot versions before the 0.1.70 and 0.1.76 sink repairs let portal users, including customer_user, store markup through POST /api/incidents/db_operations/alert/comment. The comment is rendered with v-html in AlertComment.vue without escaping or sanitization, so stored script runs for any user who views the alert, and the same pattern affects several SOC case, asset and health-check components. Because the auth store keeps access and refresh tokens in JavaScript-readable storage, an injected script can steal them and impersonate analysts or administrators.
Mitigation
The health-check sink repair is first contained in version 0.1.70, and the comment and other SOC sink repairs are first contained in version 0.1.76.