What is the CVSS score of CVE-2026-39379?

CVE-2026-39379 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N.

Which versions of GeoNetwork are affected by CVE-2026-39379?

GeoNetwork contains a reflected cross-site scripting vulnerability (CVE-2026-39379, CVSS 7.1) that allows attackers to execute arbitrary JavaScript in authenticated user sessions through a crafted…. A patch is available.

How to fix or mitigate CVE-2026-39379?

Within 24 hours: Identify all GeoNetwork instances in production and confirm network exposure status; disable internet-facing access if possible and notify all authenticated users of the vulnerability. Within 7 days: Implement Web Application Firewall (WAF) rules to filter reflected XSS payloads in URL parameters; enforce strict Content Security Policy (CSP) headers (script-src 'none' at minimum); restrict GeoNetwork access to corporate VPN or allowlisted IP ranges. Within 30 days: Monitor GeoNetwork access logs for exploitation attempts; contact Geonetwork development team for patch timeline; evaluate network segmentation or replacement if patch timeline exceeds 90 days.

GeoNetwork CVE-2026-39379

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 https://github.com/geonetwork/core-geonetwork

GHSA-2v4m-fw6c-g78f

XSS

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

vuln.today AI

6.1 MEDIUM

Reflected XSS is network-borne and easy but needs victim click (UI:R); browser-context execution escapes the server's security scope (S:C) with limited confidentiality/integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:20 vuln.today

DescriptionGitHub Advisory

Summary

It is possible to craft a URL that causes GeoNetwork to reflect attacker-controlled content into an error page in a way that gets evaluated as a client-side template expression. Combined with known AngularJS sandbox-escape techniques, this can be used to execute arbitrary JavaScript in the victim's browser (reflected Cross-Site Scripting via client-side template injection).

Details

When a user requests a service URL that does not exist or that they are not authorized to access, GeoNetwork shows an error page that reflects part of the original request back to the user without adequately neutralizing it for the context it is rendered in. Because this error page is an AngularJS application, attacker-controlled content in the reflected value can be interpreted as a template expression and evaluated once the page loads in the victim's browser, rather than being displayed as inert text.

Impact

An attacker can trick a user (including an administrator) into visiting a crafted link. The resulting script execution runs in the context of the victim's authenticated session and can be used to exfiltrate information or perform actions on the victim's behalf. For example, an attacker could inject a fake login form that looks identical to the legitimate GeoNetwork login page to harvest credentials.

GeoNetwork 3.x and 4.0.x are archived/unmaintained and will not receive a fix for this issue. Instances running those lines should upgrade to a supported release (4.2.15 or later, or 4.4.10 or later).

AnalysisAI

Reflected cross-site scripting in GeoNetwork lets a remote attacker run arbitrary JavaScript in a victim's authenticated session by luring them to a crafted service URL. Because the not-found/unauthorized error page is an AngularJS application, attacker-controlled request content reflected into that page is evaluated as a client-side template expression (AngularJS sandbox escape) rather than shown as inert text. No public exploit is identified at time of analysis, and the flaw is not on CISA KEV.

Technical ContextAI

GeoNetwork is an open-source geospatial metadata catalog and CSW server (distributed as the org.geonetwork-opensource:geonetwork Maven artifact) whose front-end error pages are rendered by AngularJS. The root cause is CWE-79 (improper neutralization of input during web page generation), specialized here as client-side template injection: when an invalid or unauthorized service URL is requested, part of the request is reflected into the AngularJS-bound error page and enters the framework's expression-evaluation pipeline. Older AngularJS versions are prone to sandbox-escape gadgets, so a reflected {{...}}-style expression can be chained into full JavaScript execution in the browser context.

RemediationAI

Upgrade to a supported, fixed release: GeoNetwork 4.2.15 or later on the 4.2 line, or 4.4.10 or later on the 4.4 line, per advisory GHSA-2v4m-fw6c-g78f (https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2v4m-fw6c-g78f). Instances on the archived 3.x or 4.0.x lines cannot be patched in place and must be migrated to a supported line. Until upgraded, compensating controls include placing a reverse proxy or WAF rule in front of GeoNetwork to block or sanitize requests whose paths/parameters contain AngularJS template syntax (e.g. characters like {{ }} in service URLs) - with the trade-off of possible false positives on legitimate requests - and restricting administrative access to trusted networks/VPN so a harvested link cannot easily reach privileged users; user awareness against clicking unsolicited GeoNetwork links also reduces exposure.