CVEvulnerability

CVE-2026-39379

7.1 HIGH Published 2026-11-03 Modified 2026-11-03 Official page ↗

Exploitation and prioritisation

CISA SSVC: exploitation: none
CISA SSVC: automatable: no
CISA SSVC: technical impact: partial
EU Vulnerability Database: EUVD-2026-116141

Affected packages

Ecosystem	Package	Vulnerable	Fixed in	Advisory
Maven	`org.geonetwork-opensource:geonetwork`	>= 3.0.0, <= 3.12.12	no fix yet	GHSA-2v4m-fw6c-g78f
Maven	`org.geonetwork-opensource:geonetwork`	>= 4.0.0-alpha.1, <= 4.0.6	no fix yet	GHSA-2v4m-fw6c-g78f
Maven	`org.geonetwork-opensource:geonetwork`	>= 4.2.0, < 4.2.15	4.2.15	GHSA-2v4m-fw6c-g78f
Maven	`org.geonetwork-opensource:geonetwork`	>= 4.4.0, < 4.4.10	4.4.10	GHSA-2v4m-fw6c-g78f

Status: Received
Published: 2026-11-03
Last modified: 2026-11-03
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Weaknesses: CWE-1336, CWE-79

Description

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.

Weakness · CWE (2)

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness
CWE-79 Improper Neutralization of Input During Web Page Generation weakness

Referenced by GitHub Advisory · alias (1)

GHSA-2v4m-fw6c-g78f GeoNetwork has reflected XSS through client-side template injection advisory · Maven