high8.2
CVE-2026-59802
PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function.
Impact
PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malicious pushes containing data:text/html URIs that execute arbitrary JavaScript in victims' browsers when clicked, enabling phishing and credential theft under the trusted PasswordPusher domain.
Affected products
| Product | Affected versions |
|---|---|
| PasswordPusher | before 2.8.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.