The vulnerability resides in Pentestify’s Markdown renderer. An authenticated user can insert a Markdown link whose URL contains a double quote that closes the anchor’s href attribute. Because the renderer’s sanitization step does not escape quotation marks, the injected script is stored and later rendered with the original origin, allowing the attacker to execute arbitrary JavaScript within the context of the application interface.

Pentestify installations from vendor maalfer older than version 2.3.2 are affected. The issue does not exist in 2.3.2 and later releases, which include escaping of quote characters during Markdown rendering.

The CVSS score of 5.1 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker must be authenticated to create a markdown entry, but once stored, the script executes in the browser of any user who views the content, enabling session theft, cookie theft, or malicious redirects. The attack vector is likely to be via the application’s text editor or documentation features.