CVE-2026-34416

OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL containing unsanitized input that breaks out of the JavaScript string and HTML attribute context in the body onload event handler to execute arbitrary scripts when the link is visited by a victim.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://gist.github.com/cyberinforepo/5a8d369a005826b6b42bfeed9607c2dd
https://www.vulncheck.com/advisories/oscal-gui-reflected-xss-via-project-parameter-in-oscal-php

Configurations

No configuration.

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) OSCAL-GUI contiene una vulnerabilidad de cross-site scripting reflejado que permite a atacantes no autenticados ejecutar JavaScript arbitrario en el navegador de una víctima inyectando entrada maliciosa a través del parámetro de solicitud project. Los atacantes pueden crear una URL maliciosa que contenga entrada no saneada que sale del contexto de cadena de JavaScript y atributo HTML en el gestor de eventos onload del cuerpo para ejecutar scripts arbitrarios cuando el enlace es visitado por una víctima.

09 Jun 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 21:17

Updated : 2026-07-23 09:10

NVD link : CVE-2026-34416

Mitre link : CVE-2026-34416

CVE.ORG link : CVE-2026-34416

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-34416", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "disclosure@vulncheck.com"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34416", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T12:55:13.407435Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/brian-ruf/OSCAL-GUI", "vendor": "brian-ruf", "product": "OSCAL-GUI", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "c989c4bd5a68f2621a81654e9250246539a28d5a"}], "packageURL": "pkg:github/brian-ruf/OSCAL-GUI", "defaultStatus": "affected"}]}], "published": "2026-06-09T21:17:08.740", "references": [{"url": "https://gist.github.com/cyberinforepo/5a8d369a005826b6b42bfeed9607c2dd", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/oscal-gui-reflected-xss-via-project-parameter-in-oscal-php", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL containing unsanitized input that breaks out of the JavaScript string and HTML attribute context in the body onload event handler to execute arbitrary scripts when the link is visited by a victim."}, {"lang": "es", "value": "OSCAL-GUI contiene una vulnerabilidad de cross-site scripting reflejado que permite a atacantes no autenticados ejecutar JavaScript arbitrario en el navegador de una v\u00edctima inyectando entrada maliciosa a trav\u00e9s del par\u00e1metro de solicitud project. Los atacantes pueden crear una URL maliciosa que contenga entrada no saneada que sale del contexto de cadena de JavaScript y atributo HTML en el gestor de eventos onload del cuerpo para ejecutar scripts arbitrarios cuando el enlace es visitado por una v\u00edctima."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "disclosure@vulncheck.com"}