CVE-2026-58205

Name of the Vulnerable Software and Affected Versions GRR versions prior to 4.5.0

Description In the maj.php endpoint, the forcemaj parameter is reflected without adequate escaping when installation files remain accessible, as their removal is not automatic. This allows for reflected cross-site scripting (XSS), where an attacker can execute arbitrary JavaScript in a victim's browser. This can lead to phishing, redirection to malicious sites, cookie theft, and session hijacking, especially since the authentication cookie lacks the HttpOnly flag, which prevents client-side scripts from accessing the cookie.

Recommendations Update to version 4.5.0. Remove installation files to prevent access to the vulnerable endpoint.