---
id: CVE-2026-40028
title: Hayabusa < 3.8.0 XSS via JSON Log Import
summary: >-
  Hayabusa versions prior to 3.8.0 contain a cross-site scripting (XSS)
  vulnerability in its HTML report output that allows an attacker to execute
  arbitrary JavaScript when a user scans JSON-exported logs containing malicious
  content in th…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: Yamato-Security
product: hayabusa
affected:
  - hayabusa <= 3.7.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-04-11T03:04:41.257641Z'
published: '2026-04-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:02:41.067Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-40028'
references:
  - url: 'https://github.com/Yamato-Security/hayabusa/releases/tag/v3.8.0'
    label: hayabusa 3.8.0 Release Notes
  - url: 'https://mobasi.ai/sentinel'
    label: Mobasi Sentinel Vulnerability Index
  - url: 'https://www.vulncheck.com/advisories/hayabusa-xss-via-json-log-import'
    label: 'VulnCheck Advisory: Hayabusa < 3.8.0 XSS via JSON Log Import'
tags:
  - cve.org
epss: 0.00208
epssPercentile: 0.10942
ingestedAt: '2026-11-08T14:51:22.446Z'
---

## Overview

Hayabusa versions prior to 3.8.0 contain a cross-site scripting (XSS) vulnerability in its HTML report output that allows an attacker to execute arbitrary JavaScript when a user scans JSON-exported logs containing malicious content in the Computer field. An attacker can inject JavaScript into the Computer field of JSON logs that executes in the forensic examiner's browser session when viewing the generated HTML report, leading to information disclosure or code execution.

## Affected

- `hayabusa <= 3.7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.