Geomap XSS via Unsanitized Template Variable Interpolation

CVE-2026-9029 represents a critical authorization bypass in geospatial visualization panels where attackers with editor-level permissions can inject persistent cross-site scripting (XSS) payloads through template variables. The vulnerability stems from a flaw in the sanitization order: the application sanitizes raw template strings before variable substitution occurs, allowing malicious payloads in variable default values to bypass HTML escaping and execute when the DOM renders via innerHTML. Any user viewing the compromised dashboard becomes a victim, making this a high-impact privilege escalation vector that affects organizations relying on shared dashboard infrastructure. This is particularly dangerous as it bypasses the previous CVE-2023-0507 mitigation, suggesting attackers have actively studied and circumvented prior security controls.

While Casky currently shows zero direct skill matches for this specific CVE, the underlying attack pattern maps to critical MITRE ATT&CK techniques that practitioners would detect through behavioral analysis: T1190 (Exploit Public-Facing Application) for the initial editor access exploitation, T1059 (Command Execution) for payload execution context, and T1566 (Phishing) when malicious dashboards are shared to distribute XSS. A Casky-powered analysis would identify the suspicious pattern of template variable manipulation combined with DOM-based code execution, flagging the unusual ordering of sanitization functions and detecting indicators of stored XSS through code flow analysis. Practitioners using Casky would see findings highlighting improper input validation sequences, unsafe HTML rendering methods, and cross-user execution patterns—enabling them to spot similar sanitize-then-interpolate bugs in other template engines before exploitation occurs.