CVE-2026-96654 Google Chronicle · YARA-L

Detect Plex Media Server Encoded URI Scheme Neutralization Vulnerability (CVE-2026-96654) in Google Chronicle

Detects exploitation and exposure of CVE-2026-96654, an improper neutralization of encoded URI schemes in a web page (CWE-84) affecting Plex Media Server v1.43.2 and earlier. An attacker can embed encoded URI schemes (e.g. percent-encoded or HTML-entity-encoded javascript:/data: scheme payloads) into content served by Plex Media Server's web UI, which are decoded and rendered in a victim's browser, enabling stored/reflected XSS and client-side script execution. This CVE is listed in the CISA KEV catalog. The detection surfaces vulnerable/unpatched Plex Media Server instances, suspicious requests containing encoded scheme payloads to Plex web endpoints, and anomalous child-process or outbound activity from the Plex Media Server process.

MITRE ATT&CK

Tactic
Initial Access Execution

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule plex_cve_2026_96654_encoded_uri_scheme {
  meta:
    author = "argus"
    description = "Detects encoded URI scheme payloads against Plex Media Server (CVE-2026-96654, CWE-84)"
    severity = "HIGH"
    reference = "CVE-2026-96654"
  events:
    $e.network.http.method = /GET|POST/
    ($e.target.port = 32400 or $e.target.url = /\/(web|library|:\/)/ nocase)
    (
      re.regex($e.target.url, `javascript%3a`) nocase or
      re.regex($e.target.url, `%6a%61%76%61%73%63%72%69%70%74`) nocase or
      re.regex($e.target.url, `data%3atext%2fhtml`) nocase or
      re.regex($e.target.url, `vbscript%3a`) nocase or
      re.regex($e.target.url, `&#x?6a;?avascript`) nocase or
      re.regex($e.target.url, `javascript`) nocase
    )
  condition:
    $e
}
high severity medium confidence

Chronicle YARA-L 2.0 rule detecting HTTP requests to Plex Media Server (port 32400 / web endpoints) containing encoded javascript:/data:/vbscript: URI schemes, matching CVE-2026-96654 exploitation.

Data Sources

UDM network/http eventsWeb proxy ingestion

Required Tables

udm.network.http

False Positives & Tuning

  • Authorized scanner traffic emitting encoded scheme fuzzing.
  • Legitimate encoded Plex deep-link/share URLs.
  • Red-team or patch-verification activity.

Other platforms for CVE-2026-96654

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Percent-encoded javascript scheme against Plex web endpoint

    Expected signal: Web/proxy access log entry and Plex Media Server.log entry showing a request to /web with a percent-encoded javascript: parameter from the test user-agent.

  2. Test 2 Hex-encoded javascript scheme payload

    Expected signal: Access log shows a /library/metadata request containing the fully percent-encoded 'javascript' token and ':' scheme.

  3. Test 3 HTML-entity-encoded scheme in stored metadata

    Expected signal: Access log and Plex Media Server.log show a /:/ request containing the HTML-entity-encoded javascript scheme; payload may persist in the library database.

Last updated: 2026-10-21 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the targeted host is running Plex Media Server and determine its version; any build at or below v1.43.2 is vulnerable to CVE-2026-96654.
  2. Decode the suspicious URI query/parameter and confirm whether it resolves to a javascript:, data:text/html, or vbscript: scheme after decoding — a genuine encoded scheme payload indicates exploitation intent.
  3. Identify the source IP and user-agent; determine whether it is an authenticated Plex user, an anonymous external client, or a known scanner.
  4. Review the HTTP response status: a 200 with the payload reflected/stored suggests the server rendered the encoded scheme (unpatched), whereas a sanitized/neutralized response suggests the patch is applied.

Containment

  1. Upgrade Plex Media Server to the fixed release (post-v1.43.2) per the Plex security advisory; this is the authoritative remediation.
  2. If immediate patching is not possible, restrict inbound access to port 32400 to trusted networks/VPN and disable remote access in Plex settings.
  3. Block the offending source IP(s) at the perimeter/WAF and add a WAF rule to strip or reject encoded javascript:/data:/vbscript: schemes to the Plex web UI.

Evidence Collection

  1. Preserve the full web/proxy access logs containing the raw and decoded request, including headers and user-agent, for the affected time window.
  2. Capture the Plex Media Server application logs (Plex Media Server.log) and version string, plus any stored library/metadata content that may contain the injected encoded payload.
  3. If client compromise is suspected, collect browser history and any session tokens or cookies that may have been exfiltrated via the XSS.

Escalation Criteria

  • !Escalate to incident response if the server is confirmed unpatched (<= v1.43.2) AND a decoded payload rendered a script context, indicating successful client-side execution.
  • !Escalate if the same encoded-scheme payload is observed stored in library/metadata (stored XSS) affecting multiple downstream clients.
  • !Escalate if post-exploitation indicators (session token theft, outbound C2 from a victim browser, or admin account compromise) are observed.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Plex Media Server.log entries showing requests to /web, /library, or /:/ endpoints with encoded query parameters.
  • >Reverse-proxy/IIS/nginx access logs containing the raw encoded-scheme request and the HTTP response code.
  • >Plex library metadata / database (com.plexapp.plugins.library.db) containing stored payloads in title or description fields.

Tuning Guidance

Baseline legitimate encoded Plex share/deep-link parameters in your environment and allowlist known scanner source IPs to reduce noise. Tighten confidence to high when the request originates from an external IP AND the server version is confirmed <= v1.43.2. If Plex is only reachable internally via VPN, scope the detection to that segment. Prefer alerting on decoded payloads rather than raw strings to catch double-encoding and HTML-entity obfuscation variants.

Hunting Queries

Hunts for any Plex web request whose URL-decoded query resolves to a dangerous URI scheme, grouped by source and user-agent to spot repeated probing or scanning.

Hunting — KQL
kql 
W3CIISLog | where csUriStem has_any ("/web","/library","/:/") | extend dec=tolower(url_decode(csUriQuery)) | where dec has "javascript:" or dec has "data:text/html" or dec has "vbscript:" | summarize count() by cIP, csUserAgent, bin(TimeGenerated, 1h)
Hunting — SPL
spl 
index=web (uri_path="/web*" OR uri_path="/library*" OR dest_port=32400) | eval dec=urldecode(lower(uri_query)) | search dec="*javascript:*" OR dec="*data:text/html*" OR dec="*vbscript:*" | stats count by src_ip http_user_agent

Atomic Red Team Tests

Test 1 Percent-encoded javascript scheme against Plex web endpoint
linux

Sends a GET request to a lab Plex Media Server with a percent-encoded javascript: scheme in a query parameter to simulate the CVE-2026-96654 encoded-scheme injection.

Command

bash 
curl -s -k 'http://plex-lab.internal:32400/web/index.html?url=javascript%3aalert(document.cookie)' -A 'cve-2026-96654-test'

Cleanup

bash 
echo 'No persistent artifact; clear any stored test entry from the Plex library if the payload was saved.'

Expected Telemetry

Web/proxy access log entry and Plex Media Server.log entry showing a request to /web with a percent-encoded javascript: parameter from the test user-agent.

Expected Detection

The kql/spl/elastic_eql detections fire on the encoded 'javascript%3a' pattern in the request to port 32400.

Test 2 Hex-encoded javascript scheme payload
linux

Delivers a fully hex-percent-encoded 'javascript' token to evade naive string matching, exercising the decode-before-match logic.

Command

bash 
curl -s -k 'http://plex-lab.internal:32400/library/metadata/1?note=%6a%61%76%61%73%63%72%69%70%74%3aalert(1)'

Cleanup

bash 
echo 'Remove the test metadata note from the lab library item if persisted.'

Expected Telemetry

Access log shows a /library/metadata request containing the fully percent-encoded 'javascript' token and ':' scheme.

Expected Detection

Detections match the '%6a%61%76%61%73%63%72%69%70%74' hex-encoded pattern or the URL-decoded 'javascript:' string.

Test 3 HTML-entity-encoded scheme in stored metadata
windows

Submits an HTML-entity-encoded javascript scheme (&#x6a;avascript / &#106;) into a Plex metadata field to simulate stored XSS via encoded-scheme neutralization bypass.

Command

powershell 
powershell -c "Invoke-WebRequest -UseBasicParsing -Uri 'http://plex-lab.internal:32400/:/scrobble?title=%26%23x6a%3Bavascript%3Aalert(1)' -Headers @{'User-Agent'='cve-2026-96654-test'}"

Cleanup

powershell 
powershell -c "Write-Host 'Delete the test library item/metadata containing the injected entity-encoded payload.'"

Expected Telemetry

Access log and Plex Media Server.log show a /:/ request containing the HTML-entity-encoded javascript scheme; payload may persist in the library database.

Expected Detection

Detections match the '&#x6a;avascript' / '&#106;avascript' HTML-entity-encoded patterns against port 32400.

Related Detections

Tactic Hubs

TA0001 Initial Access TA0002 Execution ATT&CK Matrix

Related Techniques

T1190 Exploit Public-Facing Application T1059.007 JavaScript T1189 Drive-by Compromise

Same Tactic: Initial Access

Popular Detections