EUVD-2026-52433
GHSA-7979-v6f7-5r6j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable stored XSS with scope change (S:C) as payload executes in other users' browsers; PR:L for required certificate API authentication; UI:R for victim's passive Dashboard visit.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later rendered in the Dashboard Certificates widget through Certificates.js, which interpolates the raw value into HTML attribute and text content sinks without encoding, causing injected scripts to execute in the browser of any authenticated user who views the Dashboard, enabling session hijacking or credential theft.
AnalysisAI
Stored cross-site scripting in OPNsense before 26.1.9 allows any authenticated user with certificate management access to plant a persistent JavaScript payload via the trust certificate API's description field. Once stored, the payload executes in the browser of every authenticated user who opens the Dashboard, because Certificates.js interpolates the raw description directly into an HTML attribute template literal without output encoding. No active exploitation has been confirmed (not in CISA KEV), and a vendor-released patch is available as of OPNsense 26.1.9.
Technical ContextAI
OPNsense is an open-source FreeBSD-based firewall and routing platform by Deciso B.V. (CPE: cpe:2.3:a:deciso_b.v.:opnsense). The vulnerable component is the Dashboard Certificates widget, rendered client-side via src/opnsense/www/js/widgets/Certificates.js. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) is an unencoded JavaScript template literal interpolation: the expression data-tooltip="${type}-${item.descr}" inserted the user-supplied certificate description directly into an HTML attribute sink. Because the description is sourced from the trust certificate API and persisted in configuration, the payload survives across sessions. The fix in commit 12b021ff removes item.descr from the data-tooltip attribute entirely, eliminating the injection sink without requiring explicit encoding.
RemediationAI
Upgrade to OPNsense 26.1.9 or later; the specific code fix is available in GitHub commit 12b021ff11db38705e92ac4c9af5e07d602da6ba (https://github.com/opnsense/core/commit/12b021ff11db38705e92ac4c9af5e07d602da6ba) and the release is documented at https://docs.opnsense.org/releases/CE_26.1.html#june-02-2026. As a compensating control prior to patching, restrict certificate creation and modification permissions to the smallest possible set of highly trusted administrator accounts, which reduces the pool of users who can plant a payload; this does not eliminate risk if a permitted account is compromised. Audit existing certificate description fields for XSS indicators such as angle brackets, event handler strings, or javascript: URIs to determine whether exploitation has already occurred.
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edit
DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack
A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7
A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Busines
/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 al
OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions
Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4
A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Busine
A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and
OPNsense 19.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicio
OPNsense 19.1 contains a stored cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allow
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject ma
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today