CVE-2026-41468criticalCWE-1104

CVE-2026-41468: critical vulnerability in Beghelli SicuroWeb (Sicuro24)

Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template Injection

Published

Follow this CVE+ Monitor SicuroWeb

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.3epss 0.4%
In short

Beghelli Sicuro24 SicuroWeb uses an outdated version of AngularJS that can be bypassed by attackers to run malicious code in a user's browser. This allows criminals to steal sessions, manipulate the page, or take full control of the browser without the user noticing.

Technical detail

The application embeds AngularJS 1.5.2, which contains known sandbox escape primitives exploitable via template injection. Network-adjacent attackers can deliver the injection payload through MITM attacks on plaintext HTTP connections, achieving arbitrary JavaScript execution in operator sessions without user interaction, leading to session hijacking and persistent compromise.

Summary generated and translated by AI from the official description.
Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection present in the same application, these primitives allow attackers to escape the AngularJS sandbox and achieve arbitrary JavaScript execution in operator browser sessions, enabling session hijacking, DOM manipulation, and persistent browser compromise. Network-adjacent attackers can deliver the complete injection and escape chain via MITM in plaintext HTTP deployments without active user interaction.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
Affected products
Beghelli · SicuroWeb (Sicuro24)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Beghelli SicuroWeb (Sicuro24)

In the same product, most dangerous first.

CVE-2026-22191MEDIUMBeghelli Sicuro24 SicuroWeb AngularJS Template InjectionEPSS 0.4%CVE-2026-41469MEDIUMBeghelli Sicuro24 SicuroWeb Missing Content Security PolicyEPSS 0.2%