CVE-2026-59802: Passwordpusher

High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days.

PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malicious pushes containing data:text/html URIs that execute arbitrary JavaScript in victims' browsers when clicked, enabling phishing and credential theft under the trusted PasswordPusher domain.

Affected products

• Passwordpusher Passwordpusher: before 2.8.1 (fixed in 2.8.1)

Published 2026-07-08. Last modified 2026-07-14.