CVE-2026-53472

A flaw was found in migration-planner. Insufficient validation of the "AgentStatusUpdate.CredentialUrl" field allows an authenticated attacker to store a malicious "javascript:" URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...