CVE-2026-23840: XSS in Movary Movie Tracker Application

The XSS vulnerability in Movary arises from insufficient input validation when handling the ?categoryDeleted= parameter. An attacker can craft a malicious URL containing a JavaScript payload and, when a user clicks on this link, the script will execute within the context of their browser session. This allows the attacker to steal cookies, redirect the user to a phishing site, or deface the application. The impact is significant, as successful exploitation could compromise user accounts and potentially expose sensitive movie tracking data. Given the nature of XSS, the blast radius extends to all users who interact with the vulnerable parameter, regardless of their role or privileges within the application.

1. Reserved2026-01-16
2. Published2026-01-19
3. Modified2026-01-20
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-23840 is to immediately upgrade Movary to version 0.70.0 or later, which includes the necessary input validation fixes. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious characters or patterns in the ?categoryDeleted= parameter. Additionally, carefully review and sanitize any user-supplied input within the application to prevent similar vulnerabilities from arising in the future. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into the ?categoryDeleted= parameter and verifying that it is properly sanitized and does not execute.