CVE-2026-34416

MediumCVSS 6.1

Published: 09/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

OSCAL-GUI contains a reflected XSS vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL that breaks out of the JavaScript string and HTML attribute context in the onload event handler, leading to script execution when the link is clicked.

Risk Assessment

The risk involves potential session theft, account takeover, or unauthorized actions in the victim's context, which could lead to data leakage or system integrity compromise.

Recommendation

Immediately update OSCAL-GUI to the latest patched version and implement input validation and sanitization for the project request parameter.

Other vulnerabilities in OSCAL-GUI

CVE-2026-34417Medium
Reflected XSS vulnerability in OSCAL-GUI allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious content through the project request parameter in oscal-forms.php. The parameter value is URL-decoded and assigned to project_id without sanitization, then reflected in an error message without encoding.

Original NVD description (English source)

OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL containing unsanitized input that breaks out of the JavaScript string and HTML attribute context in the body onload event handler to execute arbitrary scripts when the link is visited by a victim.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS