GeoNetwork has reflected XSS through client-side template injection

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Summary It is possible to craft a URL that causes GeoNetwork to reflect attacker-controlled content into an error page in a way that gets evaluated as a client-side template expression. Combined with known AngularJS sandbox-escape techniques, this can be used to execute arbitrary JavaScript in the victim's browser (reflected Cross-Site Scripting via client-side template injection). Details When a user requests a service URL that does not exist or that they are not authorized to access, GeoNetwork shows an error page that reflects part of the original request back to the user without adequately neutralizing it for the context it is rendered in. Because this error page is an AngularJS application, attacker-controlled content in the reflected value can be interpreted as a template expression and evaluated once the page loads in the victim's browser, rather than being displayed as inert text. Impact An attacker can trick a user (including an administrator) into visiting a crafted link.…

Published by the source

1 Jul 2026, 17:56 UTC

Last modified by the source

2 Jul 2026, 05:28 UTC

Source last checked

26 Oct 2026, 16:54 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-2v4m-fw6c-g78f

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-39379

Advisory: GeoNetwork has reflected XSS through client-side template injection
IDs: CVE-2026-39379, GHSA-2v4m-fw6c-g78f
Record: https://patchnext.com/advisories/cve-2026-39379 (revision 1, source checked 26 Oct 2026, 16:54 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Partial vendor fix; fixed versions by package: org.geonetwork-opensource:geonetwork 4.4.10, 4.2.15. A vendor fix does not mean a deployment is fixed.

## Affected components
- Maven org.geonetwork-opensource:geonetwork: affected >= 3.0.0, <= 3.12.12; >= 4.0.0-alpha.1, <= 4.0.6; >= 4.2.0, <= 4.2.14; >= 4.4.0, <= 4.4.9; fixed in 4.2.15, 4.4.10

## Suggested inspection (read-only)
- Maven org.geonetwork-opensource:geonetwork: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on org.geonetwork-opensource:geonetwork.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-2v4m-fw6c-g78f (GitHub-reviewed advisory GHSA-2v4m-fw6c-g78f lists affected ranges: Maven org.geonetwork-opensource:geonetwork >=3.0.0 =4.0.0-alpha.1 =4.2.0 =4.4.0 <=4.4.9)

Commands are suggestions: review each one before running it.