CVE-2022-42948 Fortra Cobalt Strike User Interface Remote Code Execution

Exploited in the wild Critical 9.8 Published 24 Mar 2023 Updated 21 Oct 2025

Attackers can execute arbitrary code in the Cobalt Strike operator interface by injecting malicious HTML into Swing components.

Exploited in the wild: Since 30 Mar 2023
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-42948?

CVE-2022-42948 is a critical cross-site scripting vulnerability in n/a, published on 24 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.

Weakness: CWE-116

Which versions are affected by CVE-2022-42948?

It affects 1 product.

Products include Helpsystems Cobalt Strike.

How do I fix CVE-2022-42948?

No fix has been published for CVE-2022-42948 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 20 Apr 2023.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-42948 being exploited?

Yes. Attackers have exploited CVE-2022-42948 in the wild since at least 30 Mar 2023.

Sources

Also known as GHSA-c8qh-hq9w-qh3p.