CVE-2026-55081
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
XSS vulnerability in DHIS2 versions 2.42 and 2.43 before the 2026-06-09 security patches, and in the 2.44 development branch. An attacker can inject active HTML or JavaScript via the scope parameter in the OpenAPI HTML endpoint.
Risk Assessment
Risk of malicious script execution in the user's browser within the DHIS2 context, potentially leading to session theft or data leakage.
Recommendation
Update DHIS2 to version 2.42.5.1, 2.43.0.1, or later. For version 2.44, apply the fix from the development branch.
Other vulnerabilities in DHIS2
See all- CVE-2026-55084High
DHIS2 (versions 2.37-2.44) contains a SQL injection vulnerability in the SqlView API endpoint. An authenticated user with SqlView access can inject arbitrary SQL queries via the filter parameter by abusing a PostgreSQL expression, with output reflected in error messages.
- CVE-2026-55082High
Vulnerability in DHIS2 SQL View data endpoints. Authenticated users with SQL View access can provide crafted filter values that are interpolated into generated SQL, potentially accessing data outside the intended result set.
Original NVD description (English source)
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A crafted `scope` value could be rendered as active HTML or JavaScript in the OpenAPI documentation page. An attacker able to get a user to open a crafted OpenAPI HTML URL could execute JavaScript in that user's browser in the DHIS2 origin. Affected versions: DHIS2 2.42 and 2.43 before the 2026-06-09 security patch releases, and the development branch for DHIS2 2.44 before the fix was merged. Patched in 2.42.5.1, 2.43.0.1, the 2.42 and 2.43 line branches, and the 2.44 development branch.