{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "title": "Thales Sentinel LDK Runtime Stored XSS",
    "tracking": {
      "current_release_date": "2026-04-07T20:50:15Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.13.0+build.51"
        }
      },
      "id": "VA-26-097-01",
      "initial_release_date": "2026-04-07T20:50:15Z",
      "status": "final",
      "version": "1.0.0",
      "revision_history": [
        {
          "number": "1.0.0",
          "summary": "Initial publication",
          "date": "2026-04-07T20:50:15Z"
        }
      ]
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice",
        "category": "legal_disclaimer"
      },
      {
        "text": "Worldwide",
        "title": "Countries and Areas Deployed",
        "category": "other"
      },
      {
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors",
        "category": "other"
      },
      {
        "text": "Thales Sentinel LDK Runtime on Windows allows Stored Cross-site Scripting.",
        "title": "Risk Evaluation",
        "category": "summary"
      },
      {
        "text": "Upgrade to version 10.22 or later.",
        "title": "Recommended Practices",
        "category": "general"
      },
      {
        "text": "United States",
        "title": "Company Headquarters Location",
        "category": "other"
      }
    ],
    "references": [
      {
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-097-01.json",
        "summary": "Vulnerability Advisory VA-26-097-01 CSAF",
        "category": "self"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Thales",
        "branches": [
          {
            "category": "product_name",
            "name": "Sentinel LDK Runtime",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<10.22",
                "product": {
                  "name": "Thales Sentinel LDK Runtime <10.22",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "10.22",
                "product": {
                  "name": "Thales Sentinel LDK Runtime 10.22",
                  "product_id": "CSAFPID-0002"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-3457",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Thales Sentinel LDK Runtime on Windows allows Stored Cross-site Scripting. Fixed in Sentinel LDK Runtime 10.22.",
          "title": "Description"
        }
      ],
      "title": "Thales Sentinel LDK Runtime Stored XSS",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ],
        "fixed": [
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "supportportal.thalesgroup.com",
          "url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=5c18186b478aa950128dca72e36d4391&sysparm_article=KB0027106"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3457"
        },
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-097-01.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 10.22.",
          "url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=5c18186b478aa950128dca72e36d4391&sysparm_article=KB0027106",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "date": "2026-03-27T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 10.22.",
          "url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=5c18186b478aa950128dca72e36d4391&sysparm_article=KB0027106",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2026-03-27T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Josh Dillon"
          ]
        }
      ],
      "release_date": "2026-03-27T00:00:00Z"
    }
  ]
}