OCO-Server CVE-2026-61791

Three concrete prerequisites must all hold: (1) the 'agent-self-registration-enabled' setting must be turned on - it defaults to 0 (disabled), so default installs are not exposed via this path; (2) the attacker must possess the shared 'agent-registration-key' used by all agents (it can leak from any one enrolled machine and be reused to register arbitrary ghost computers via the oco.agent.hello handler in frontend/api-agent.php); and (3) an administrator must subsequently open the malicious computer's details page and activate (click) one of the default VNC/RDP/SSH/Ping command buttons, which all use new_tab=false and the vulnerable window.location onclick branch. No custom command configuration is required - the vulnerable buttons ship enabled on every install. Limiting factors that narrow real-world risk: the non-default self-registration setting, the shared-secret requirement, and the need for authenticated-admin interaction (UI:R).

This is a High-severity (CVSS 7.4) stored XSS in a niche product, and the signals point to a real-but-gated issue rather than a mass-exploitation emergency. Positive signals: the vendor GHSA advisory confirms the flaw, the fix (1.2.1), and includes a three-stage reproduction (real PHP Html::commandButton() → Python html.parser → Node/V8) proving the injected JavaScript actually executes; the vuln.today Decision label is 'this_week'; technical impact is high (full admin-session compromise with fleet-wide software-deployment ability). Mitigating signals: it is NOT listed in CISA KEV (no confirmed active exploitation), no EPSS score is provided in the input (exploitation probability unknown - state explicitly), and the attack is not automatable/wormable - it requires a non-default setting (agent-self-registration-enabled, which defaults to 0), possession of the shared agent-registration-key, and an administrator both opening the malicious computer-details page and clicking a default command button (UI:R). The CVSS vector (AV:N/PR:N) marks it network-reachable and 'unauthenticated,' but note the tension: PR:N does not reflect that an attacker must hold the shared registration key and that self-registration must be enabled - these are real preconditions the base vector does not capture. Net: a legitimate 'patch this cycle' item (consistent with the 'this_week' label) for anyone running OCO-Server with self-registration on, but low risk of indiscriminate widespread exploitation.

An attacker who has obtained the shared agent-registration-key (for example by reading it from one already-enrolled workstation) targets an OCO-Server where agent-self-registration-enabled is turned on, and uses the oco.agent.hello handler to register a ghost computer whose hostname carries a crafted payload that breaks out of the onclick JS string. When an administrator later opens that computer's details page and clicks one of the default VNC/RDP/SSH/Ping buttons, the payload runs in the admin's authenticated session and can deploy software jobs fleet-wide. The GHSA advisory documents a confirmed reproduction of the JavaScript executing, though no standalone weaponized exploit tool is published.