CVE-2026-34417

Name of the Vulnerable Software and Affected Versions OSCAL-GUI (affected versions not specified)

Description An unauthenticated attacker can execute arbitrary JavaScript in a user's browser via a reflected cross-site scripting issue. The attack occurs by injecting malicious content through the project request parameter in the 'oscal-forms.php' endpoint. The value of this parameter is URL-decoded and assigned to the project id variable in 'oscal-functions.php' without sanitization. If the provided project ID is not found, the Messages() function concatenates the unsanitized value into an error message, which is then reflected in the HTML response body without encoding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.