EntroVyx/CVE-2026-33657

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to EspoCRM, creates a Note containing attacker-controlled HTML, and confirms storage of the payload. The script is designed to exercise CVE-2026-33657 by injecting HTML that will be rendered unescaped in email notifications.

Backdoor review

No backdoor observed in reviewed code

The PoC script CVE-2026-33657.py and its README.md describe and implement an authenticated stored HTML injection exploit against EspoCRM 9.3.3, consistent with the claimed CVE-2026-33657. The script uses provided credentials to authenticate, optionally fingerprint the version, create a Note containing attacker-controlled HTML, and confirm storage. No concealed executable behavior, unrelated payload, credential exfiltration, persistence mechanism, or operator-directed harm was observed. The script's actions are limited to the described exploit flow.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwareespocrm
Attack typesstored html injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively creates a malicious Note with HTML payload on a target EspoCRM instance, which is the core action needed to trigger the stored HTML injection vulnerability. It does not merely detect the version or report exposure; it performs the injection step.

CVE-2026-33657.py:3CVE-2026-33657.py:90-104CVE-2026-33657.py:256

Requirements

  • Valid EspoCRM credentials with permission to create stream NotesCVE-2026-33657.py:177-178
  • Notification target via --mention or --target-user-idCVE-2026-33657.py:204-207

Observed behavior

  • Authenticates to EspoCRM using supplied credentialsCVE-2026-33657.py:193-196
  • Optionally fingerprints EspoCRM version via /api/v1/App/userCVE-2026-33657.py:209-218
  • Creates a Note with attacker-controlled HTML in the post fieldCVE-2026-33657.py:220-232
  • Confirms the stored Note contains the injected HTML payloadCVE-2026-33657.py:252-256
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
http://attacker.example/track.gifDefault tracking pixel URL used in the default payload, consistent with the described HTML injection for email tracking.CVE-2026-33657.py:183
Url
javascript:alert(33657)Default link URL used in the default payload, consistent with demonstrating HTML injection impact.CVE-2026-33657.py:184
Review boundaries

What the analysis did not establish

  • The script does not trigger or verify email delivery; it only stores the payload and relies on the server's notification job to send the email.
  • The evidence does not include execution output or confirmation that the script was run against a live target.
  • One file (metadata only) was not provided as text and was not analyzed; its content is unknown.
  • The review is limited to static analysis of the supplied text; the script was not executed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1