Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template Injection
Summary
| CVE | CVE-2026-41468 |
|---|---|
| State | PUBLISHED |
| Assigner | VulnCheck |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-04-22 19:17:08 UTC |
| Updated | 2026-04-22 21:18:45 UTC |
| Description | Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection present in the same application, these primitives allow attackers to escape the AngularJS sandbox and achieve arbitrary JavaScript execution in operator browser sessions, enabling session hijacking, DOM manipulation, and persistent browser compromise. Network-adjacent attackers can deliver the complete injection and escape chain via MITM in plaintext HTTP deployments without active user interaction. |
Risk And Classification
Primary CVSS: v4.0 9.3 CRITICAL from [email protected]
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-1104 | CWE-1104 CWE-1104 Use of Unmaintained Third-Party Components
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 9.3 | CRITICAL | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/C... |
| 4.0 | CNA | CVSS | 9.3 | CRITICAL | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L |
| 3.1 | [email protected] | Primary | 8.7 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L |
| 3.1 | CNA | CVSS | 8.7 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L |
CVSS v4.0 Breakdown
Attack Vector
AdjacentAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
PassiveConfidentiality
HighIntegrity
HighAvailability
LowSub Conf.
HighSub Integrity
HighSub Availability
LowCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
AdjacentAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
ChangedConfidentiality
HighIntegrity
HighAvailability
LowCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Beghelli | SicuroWeb Sicuro24 | affected | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-POC.py | [email protected] | github.com | |
| github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-SicuroWeb-ATI-c... | [email protected] | github.com | |
| www.boffsec-services.com/posts/sicuroweb-cve-2026-22191 | [email protected] | www.boffsec-services.com | |
| www.vulncheck.com/advisories/beghelli-sicuro24-sicuroweb-angularjs-sandbox-esca... | [email protected] | www.vulncheck.com | |
| www.beghelli.it | [email protected] | www.beghelli.it | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Jean-Marie Bourbon of Bourbon Offensive Security Services (en)
CNA: VulnCheck (en)
There are currently no legacy QID mappings associated with this CVE.