CVE-2026-90443

CISA Malcolm’s web interface has an unauthenticated reflected cross-site scripting flaw (CWE-79). A portion of the request URL is written into a script context and a hyperlink attribute without adequate encoding, so an attacker can send a crafted link that runs arbitrary script in the application’s origin when a user opens it and can also send the browser to an arbitrary external site. Exploitation needs that user click and can then act with the victim’s session privileges inside Malcolm, with limited confidentiality and integrity impact (CVSS 4.0 base 5.3). The issue affects Malcolm deployments whose versions are not named in the advisory data. It is not on the CISA KEV list, and no public proof-of-concept is known.

What to do: Keep the Malcolm web interface off the public internet and limit it to trusted analyst networks. Do not open unsolicited links that point at the interface, and apply CISA’s patched Malcolm release as soon as it is published (no fixed version is named in the advisory data). If a user may have followed a suspicious link, invalidate that session and review actions taken under it.