p PatchFirst

PatchFirst · Latest vulnerabilities

wetty vulnerabilities

Vulnerabilities published for wetty in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-49864

    High · CVSS 8.6EPSS 0.44%Fix available

    wetty vulnerable to DOM XSS via file-download filename

    wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (`escapeMarkup: false`). Any output the victim renders - a `cat`'d file, a tailed log, an SSH MOTD, a `curl` response - that contains `\x1b[5i...:...\x1b[4i` runs script in the wetty origin and types attacker-chosen keystrokes into the victim's SSH session. Version 3.0.4 fixes the issue.

    wettyNode.js
    • Update to 3.0.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →