CVE-2026-49864

CVE-2026-49864 (Wetty) is a DOM XSS in the Wetty client (prior to v3.0.4) triggered by a crafted file-download escape sequence that decodes a base64 filename and injects it into a Toastify HTML string without escaping. The attacker-controlled filename can lead to raw HTML/JS rendering in the vict...