Mythic versions 3.2.16 through 3.4.0.61 contain a stored cross‑site scripting flaw. By embedding crafted HTML inside files named with a .pdf extension that are downloaded by an Agent, the content‑sniffed HTML is served from /direct/view and rendered within the Mythic UI’s same‑origin context. The embedded JavaScript runs with the UI’s privileges, allowing an attacker to read localStorage and extract the stored JWT, which then grants full GraphQL and REST API access. This vulnerability is classified as CWE‑79 and represents a typical stored XSS that can compromise session data and other client‑side secrets.

Affected products are Mythic deployments built from the its‑a‑feature repository. The problem exists in all releases between 3.2.16 and 3.4.0.61 inclusive. No specific patches are listed in the input, but any newer release beyond 3.4.0.61 resolves the issue. The software is open‑source and exposed through a web UI, so the vulnerability could affect any organization using the provided Mythic version in a web‑based threat‑intel environment.

The CVSS base score is 7.4, indicating a high potential impact, but the EPSS score is not available to quantify current exploitation likelihood. The vulnerability is not included in CISA’s KEV catalog, suggesting no known mass exploitation yet. Attackers with access to an endpoint that can introduce arbitrary files can trigger the flaw by placing malicious “.pdf” files on the target; when an operator later uses the Preview Media feature, the embedded script executes. The risk is limited to environments where operators preview agent‑downloaded files and rely on the UI’s localStorage for authentication. As no remote code execution is possible outside the UI, the impact is confined to the web session context.