Workbench CVE-2026-34951

CVSS v4.0 score of 5.1 (medium severity) reflects limited impact: remote network attack vector (AV:N), low complexity (AC:L), no authentication required (PR:N), but requires user interaction (UI:A) and results only in low confidentiality and integrity impact (VC:L, VI:L). The EPSS exploitation probability is not provided, preventing comparative risk analysis. No KEV status or public proof-of-concept code is reported. From an SSVC perspective, this is a reflected XSS on an error page-exploitation requires social engineering to trick a user into clicking a malicious link containing the payload, making practical attack success dependent on user awareness. The limited impact scope (error pages only) and user interaction requirement substantially reduce real-world risk versus stored XSS or high-impact reflected XSS. This is a legitimate medium-risk issue, not an inflated CVSS score.

An attacker crafts a malicious URL containing a JavaScript payload in the footerScripts parameter and shares it via email or social media with a Workbench user. When the user clicks the link, the unvalidated parameter is reflected in the error page, executing the attacker's script in the victim's browser within the Workbench application context. The script could steal session cookies, capture credentials, or redirect the user to a phishing site. Exploitation requires the user to click the malicious link and is limited to the scope of the Workbench application session.