EUVD-2026-52869
GHSA-hc58-x27q-7xc8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint, high complexity due to content-type negotiation prerequisite, no auth required, mandatory user click; XSS yields limited C and I but no server-side availability impact.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
4DescriptionCVE.org
SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3.
AnalysisAI
Reflected XSS in Snowstorm's Web Route redirection endpoint allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted malicious link. The vulnerability resided in a Spring Boot REST controller's error-handling path, where attacker-controlled input in the uri parameter was reflected verbatim in a 400 Bad Request response body; when combined with an Accept: text/html request header, Spring's content negotiation rendered the response as HTML, enabling script injection. No CISA KEV listing or public exploit code was identified at time of analysis; two upstream patch commits and a CISA advisory reference confirm vendor acknowledgment and fix availability in versions 10.12.2 and 10.9.3.
Technical ContextAI
Snowstorm (CPE: cpe:2.3:a:snomed_international:snowstorm:*:*:*:*:*:*:*:*) is SNOMED International's open-source SNOMED CT clinical terminology server built on Spring Boot. The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation). In WebRouteController.java, the issueRedirect method accepted a uri query parameter and attempted to build a redirect. When input validation failed, the original catch block returned new ResponseEntity<>(e.toString(), HttpStatus.BAD_REQUEST) - embedding the attacker-controlled uri value directly in the response body as a raw String. Spring's content negotiation honored an Accept: text/html request header, setting Content-Type: text/html on the error response and causing the browser to parse and execute injected script. The fix, visible in the commit diff, removes the catch block entirely and lets the IllegalArgumentException propagate to RestControllerAdvice, which serializes it as JSON - eliminating the HTML rendering path and the reflection vector.
RemediationAI
Upgrade Snowstorm to version 10.12.2 or 10.9.3, which incorporate the fixes delivered in the two upstream commits (https://github.com/IHTSDO/snowstorm/commit/575b555695811110dafe2fcea7dd2fd7e4bcee39 and https://github.com/IHTSDO/snowstorm/commit/b8061add427c930b3030549e77aa23ec5957ceb6). If immediate patching is not feasible, consider the following compensating controls with their trade-offs: block external access to the /web-route endpoint at the network or reverse-proxy layer if browser-facing redirect functionality is not required in exposed deployments, noting this will break any legitimate Web Route redirects in use; deploy a Web Application Firewall rule to reject requests where the uri parameter contains script tags or JavaScript event-handler patterns, bearing in mind that obfuscated payloads can bypass WAF rules; add a Content-Security-Policy: default-src 'self'; script-src 'self' response header to prevent execution of inline scripts, which neutralizes most reflected XSS payloads without altering application logic but requires testing for compatibility with any existing client-side scripts. The patch is the only complete fix; all workarounds reduce but do not eliminate risk.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today