CVE-2026-61791

Name of the Vulnerable Software and Affected Versions OCO-Server versions prior to 1.2.1

Description An issue exists where the Html::commandButton() function in lib/Html.class.php embeds a stored computer hostname into a JavaScript string within an inline onclick handler. Because only htmlspecialchars(ENT QUOTES) is used for HTML escaping, browsers decode these entities before executing the JavaScript, allowing a crafted hostname to escape the string and execute arbitrary script in an administrator's authenticated session. The frontend/views/computer-details.php file passes the $computer->hostname variable to this helper via Computer::DEFAULT COMPUTER COMMANDS in lib/Models/Computer.class.php, specifically affecting VNC, RDP, SSH, and Ping entries that use the window.location branch. A remote attacker with the shared agent-registration-key can store a malicious hostname using the oco.agent.hello handler in the frontend/api-agent.php endpoint if agent-self-registration-enabled is active. This can lead to the abuse of administrator privileges, such as deploying software jobs to managed computers.

Recommendations Update to version 1.2.1. Disable the agent-self-registration-enabled setting to prevent unauthorized hostname storage.