PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malicio…

CVE-2026-59802 affects PasswordPusher versions before 2.8.1, where insufficient validation in the valid_url function allows attackers to inject data URI schemes (data:text/html) into URL push payloads. When victims click these malicious links, arbitrary JavaScript executes in their browsers under the trusted PasswordPusher domain. This enables phishing attacks and credential theft, as the malicious content appears to originate from a trusted password-sharing service. The vulnerability is classified as a redirect-based XSS via data URI. A fix was introduced in version 2.8.1. The issue is documented in the official GitHub security advisory and by VulnCheck.