Reflected XSS in DHIS2 OpenAPI HTML scope parameter (CVE-2026-55081)

The DHIS2 OpenAPI HTML endpoint reflects values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A crafted `scope` value can be rendered as active HTML or JavaScript in the OpenAPI documentation page. An attacker who can persuade a user to open a crafted OpenAPI HTML URL can execute arbitrary JavaScript in that user's browser within the DHIS2 origin. Affected versions: - 2.42.x before 2.42.5.1 - 2.43.0 before 2.43.0.1 - 2.44 development branch before PR #24162 We recommend updating to: 2.42.5.1, 2.43.0.1, 2.44 development branch after PR #24162. CVSS 7.3 · our assessment: this_week Reference: https://github.com/dhis2/dhis2-core/security/advisories/GHSA-6785-hj47-c27h Details: https://vuln.today/cve/CVE-2026-55081