Een PinchTab Security Policy Bypass in /wait Maakt Willekeurige JavaScript Uitvoering Mogelijk

The primary impact of CVE-2026-33622 is the ability for an attacker to execute malicious JavaScript code in the context of a victim's browser session. This can be exploited to steal sensitive information, such as cookies and authentication tokens, allowing the attacker to impersonate the user. Furthermore, an attacker could modify the content of the page displayed to the user, potentially leading to phishing attacks or the injection of malware. The bypass of the security.allowEvaluate setting significantly increases the risk, as it circumvents a designed security control. This vulnerability is particularly concerning given PinchTab's potential use in managing browser tabs and workflows, which could expose a wide range of user data and activities.

Organizations and individuals using PinchTab versions 0.8.3 through 0.8.5 are at risk. This includes users who have integrated PinchTab into their workflows or applications, particularly those who rely on the 'fn' mode for dynamic tab management. Shared hosting environments where PinchTab is deployed could expose multiple users to the vulnerability.

• linux / server:

journalctl -u pinchtab | grep -i 'fn' -i 'evaluate'

• generic web:

curl -s 'https://your-pinchtab-instance/wait?fn=alert("XSS")' | grep -i 'XSS'

1. 2026-03-24Disclosure

   disclosure

1. Gereserveerd2026-03-23
2. Gepubliceerd2026-03-24
3. Gewijzigd2026-03-27
4. EPSS bijgewerkt2026-04-03

The most effective mitigation for CVE-2026-33622 is to upgrade to a patched version of PinchTab that addresses the vulnerability. Unfortunately, a specific fixed version is not provided in the input. Until a patch is released, disabling the 'fn' mode in the PinchTab configuration is a crucial workaround. This prevents the vulnerable endpoints from being exploited. If upgrading is not immediately feasible, carefully review and restrict access to the /wait and /tabs/{id}/wait endpoints. Consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious JavaScript code in the 'fn' parameter. Monitor application logs for unusual activity or attempts to exploit the vulnerable endpoints.