CVE-2026-34417

OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious content through the project request parameter in oscal-forms.php. The parameter value is URL-decoded and assigned to the project_id variable without sanitization in oscal-functions.php, and when the supplied project ID is not found, the unsanitized value is concatenated into an error message via the Messages() function and reflected into the HTML response body without encoding.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://gist.github.com/cyberinforepo/5a8d369a005826b6b42bfeed9607c2dd
https://www.vulncheck.com/advisories/oscal-gui-reflected-xss-via-project-parameter-in-oscal-forms-php

Configurations

No configuration.

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) OSCAL-GUI contiene una vulnerabilidad de cross-site scripting reflejado que permite a atacantes no autenticados ejecutar JavaScript arbitrario en el navegador de una víctima inyectando contenido malicioso a través del parámetro de solicitud project en oscal-forms.php. El valor del parámetro se decodifica por URL y se asigna a la variable project_id sin sanitización en oscal-functions.php, y cuando no se encuentra el ID de proyecto proporcionado, el valor no sanitizado se concatena en un mensaje de error a través de la función Messages() y se refleja en el cuerpo de la respuesta HTML sin codificación.

09 Jun 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 22:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-34417

Mitre link : CVE-2026-34417

CVE.ORG link : CVE-2026-34417

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-34417", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "disclosure@vulncheck.com"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34417", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T14:23:10.708622Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/brian-ruf/OSCAL-GUI", "vendor": "brian-ruf", "product": "OSCAL-GUI", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "c989c4bd5a68f2621a81654e9250246539a28d5a"}], "packageURL": "pkg:github/brian-ruf/OSCAL-GUI", "defaultStatus": "affected"}]}], "published": "2026-06-09T22:16:22.620", "references": [{"url": "https://gist.github.com/cyberinforepo/5a8d369a005826b6b42bfeed9607c2dd", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/oscal-gui-reflected-xss-via-project-parameter-in-oscal-forms-php", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious content through the project request parameter in oscal-forms.php. The parameter value is URL-decoded and assigned to the project_id variable without sanitization in oscal-functions.php, and when the supplied project ID is not found, the unsanitized value is concatenated into an error message via the Messages() function and reflected into the HTML response body without encoding."}, {"lang": "es", "value": "OSCAL-GUI contiene una vulnerabilidad de cross-site scripting reflejado que permite a atacantes no autenticados ejecutar JavaScript arbitrario en el navegador de una v\u00edctima inyectando contenido malicioso a trav\u00e9s del par\u00e1metro de solicitud project en oscal-forms.php. El valor del par\u00e1metro se decodifica por URL y se asigna a la variable project_id sin sanitizaci\u00f3n en oscal-functions.php, y cuando no se encuentra el ID de proyecto proporcionado, el valor no sanitizado se concatena en un mensaje de error a trav\u00e9s de la funci\u00f3n Messages() y se refleja en el cuerpo de la respuesta HTML sin codificaci\u00f3n."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "disclosure@vulncheck.com"}