GRR CVE-2026-58205

Exploitation requires that the GRR installation files - specifically installation/maj.php - remain present and web-accessible on the server; the advisory states this cleanup is manual and not automatic, so this is the decisive non-default precondition. The attacker must also induce an authenticated victim to open a crafted URL carrying the payload in the forcemaj GET parameter (user interaction required, UI:R). The impact is amplified because the GRR authentication cookie is not set HttpOnly, allowing injected JavaScript to read it for session hijacking. Limiting factors: instances that deleted the installation directory after setup are not exploitable, and the attack fails without victim interaction; affected versions are GRR <= 4.4.2, fixed in 4.5.0.

This is a reflected XSS (CWE-79) with a provided CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N (base 8.1). The PR:N component means the flaw itself requires no attacker authentication, and UI:R correctly reflects that a victim must open an attacker-crafted URL. However, the single most important mitigating signal comes from the vendor advisory (GHSA-r6x2-w38j-vvq2), not the CVSS vector: exploitation is only possible if the GRR installation files (specifically installation/maj.php) have not been deleted, and that cleanup is explicitly not automatic. The published CVSS vector does NOT encode this precondition, so the 8.1 base score overstates risk for any deployment that followed post-install hardening - this is a case where the vector and the description diverge, and defenders should treat the leftover-install-files condition as the real gating factor. No EPSS score and no CISA KEV status were supplied, so exploitation probability and active-exploitation evidence cannot be assessed from this input; absence of these signals is not evidence of safety but also not evidence of mass exploitation. The input references are the vendor advisory, the fix commit, and the v4.5.0 tag - these are patch/disclosure artifacts, not a working exploit, so there is no public exploit identified at time of analysis. The vuln.today Decision label is this_week, indicating a prompt-but-not-emergency remediation priority consistent with a patched, condition-dependent XSS in a niche product. Net assessment: a genuine high-severity XSS where real-world impact hinges on whether install files were removed; for correctly hardened installations the practical risk is substantially lower than 8.1 implies.

An attacker identifies a GRR instance where the installation directory was never removed, making installation/maj.php reachable, and crafts a URL embedding a malicious payload in the forcemaj parameter. The attacker delivers this link to an authenticated GRR user (e.g., via phishing email); when the victim opens it, arbitrary JavaScript executes in their browser and, because the GRR authentication cookie is not flagged HttpOnly, the script can steal the session cookie and hijack the session. No working public exploit was provided in the input, only the vendor advisory and fix commit.