Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-55696, describes a Stored Cross-Site Scripting (XSS) issue in PrivateBin related to attachment download links. Specifically, the AttachmentViewer.setAttachment function in js/privatebin.js was identified as the point where attacker-controlled MIME types were accepted and used to create a same-origin blob URL. This blob URL was then set as the href for the 'Download attachment' link. When a user clicked this link, especially for MIME types like text/html or image/svg, the browser could render the content, leading to the execution of arbitrary JavaScript in the PrivateBin origin.
The provided patch clearly shows the modification within the jQuery.PrivateBin.AttachmentViewer.setAttachment function. Before the fix, the getBlobUrl function was called directly with the mimeType (- let blobUrl = getBlobUrl(decodedData, mimeType);). The patch introduces a safeMimeType variable, which defaults to application/octet-stream and is only assigned the original mimeType if me.isSafeMimeType(mimeType) returns true. This change ensures that potentially dangerous MIME types are forced to download as generic binary files, preventing their execution in the browser. The isSafeMimeType function itself is a mitigation, not the vulnerable component. Therefore, the jQuery.PrivateBin.AttachmentViewer.setAttachment function is the precise vulnerable function because it was responsible for creating the unsafe blob URL using unsanitized MIME types.
jQuery.PrivateBin.AttachmentViewer.setAttachmentjs/privatebin.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| privatebin/privatebin | composer | <= 2.0.4 | 2.0.5 |