CVE-2026-34417

MediumCVSS 6.1

Published: 09/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

Reflected XSS vulnerability in OSCAL-GUI allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious content through the project request parameter in oscal-forms.php. The parameter value is URL-decoded and assigned to project_id without sanitization, then reflected in an error message without encoding.

Risk Assessment

An attacker can steal session cookies, redirect the user to a malicious site, or perform other actions in the context of the victim's session.

Recommendation

Apply the patch provided by OSCAL-GUI developers or implement input sanitization and output encoding for the project_id parameter.

Other vulnerabilities in OSCAL-GUI

CVE-2026-34416Medium
OSCAL-GUI contains a reflected XSS vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL that breaks out of the JavaScript string and HTML attribute context in the onload event handler, leading to script execution when the link is clicked.

Original NVD description (English source)

OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious content through the project request parameter in oscal-forms.php. The parameter value is URL-decoded and assigned to the project_id variable without sanitization in oscal-functions.php, and when the supplied project ID is not found, the unsanitized value is concatenated into an error message via the Messages() function and reflected into the HTML response body without encoding.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS