Alertus Desktop Alert: Unauthenticated Remote HTML Injection (CVE-2026-38903)
A public proof-of-concept (PoC) exists for CVE-2026-38903, an unauthenticated remote HTML injection vulnerability in Alertus Desktop Alert v5.4.98.0. The vulnerability stems from a certificate validation bypass that allows attackers to render arbitrary HTML and execute JavaScript within a Trident WebBrowser control.
CVE search metadata
CVE search record: CVE-2026-38903. Severity: medium. CVSS: 6.1. KEV: no. Product: Desktop Alert (v5.4.98.0). Brief: Alertus Desktop Alert: Unauthenticated Remote HTML Injection (CVE-2026-38903). Brief link: https://feed.craftedsignal.io/briefs/2026-10-alertus-desktop-alert-rce/
Triage facts
Revision 1- Applicability
- Desktop Alert (v5.4.98.0)
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 26, 22:07 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
Alertus Desktop Alert v5.4.98.0 for Windows is susceptible to remote HTML injection due to a failure in the PKI module to validate certificate chains. An attacker who can redirect DNS resolution can serve forged responses signed with an attacker-generated key. The client renders this input in a Trident (IE) WebBrowser control without sanitization, enabling JavaScript execution, protocol handler navigation, and the spawning of registered executables.