TI-2026-36765 Aliases CVE-2026-49864 GHSA-p26j-h7wj-r568

wetty vulnerable to DOM XSS via file-download filename

HIGH 70CWE-79Published 2026-08-13 · Updated 2026-08-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (`escapeMarkup: false`). Any output the victim renders - a `cat`'d file, a tailed log, an SSH MOTD, a `curl` response - that contains `\x1b[5i...:...\x1b[4i` runs script in the wetty origin and types attacker-chosen keystrokes into the victim's SSH session. Version 3.0.4 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00444 38th percentileScored 2026-11-07

Fix Fixed wetty (butlerx): 3.0.4wetty (npm): 3.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
butlerx	wetty	before 3.0.4	3.0.4	Patch available	CNA
—	wetty (npm)	before 3.0.4	3.0.4	Patch available	GHSA-p26j-h7wj-r568

wetty Vendorbutlerx Affected before 3.0.4 Fixed in 3.0.4 Patch available CNA
wetty (npm) Vendor— Affected before 3.0.4 Fixed in 3.0.4 Patch available GHSA-p26j-h7wj-r568

Remediation

Fix · CNA wetty (butlerx) Fixed in 3.0.4
Fix · GHSA-p26j-h7wj-r568 wetty (npm) Fixed in 3.0.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-49864
2026-10-03 Alias added: GHSA-p26j-h7wj-r568

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences