PinchTab versions 0.8.3 through 0.8.5 leak the ability to run arbitrary JavaScript in a Chrome browser when a user performs a POST to /wait or /tabs/{id}/wait in fn mode. The server evaluates the function expression directly, ignoring the security.allowEvaluate flag that normally blocks such code. This flaw is a security‑policy bypass rather than a new authentication hole, yet it allows any authenticated caller with the server token to execute code in the tab context, exposing the browser’s data and potentially compromising the operator’s environment. The underlying weakness aligns with CWE‑284 (Improper Authorization), CWE‑693 (Protection Mechanism Failure), and CWE‑94 (Improper Control of Generation of Code).

The affected product is PinchTab by PinchTab, Inc. The problem exists only in the 0.8.3, 0.8.4, and 0.8.5 releases; newer builds are not affected, and a patched version has not yet been released as of the advisory date.

The CVSS score of 6.1 indicates a medium severity. Because the exploit requires an authenticated API token, an attacker must first obtain valid credentials, which limits the risk to users who have that token. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploits at present. Nonetheless, any user who can authenticate to the PinchTab server could leverage this flaw to execute arbitrary code in the browser context, making it a significant threat to confidentiality and integrity for those users.