CVE-2026-40302

{"id": "CVE-2026-40302", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40302", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-18T03:07:00.447331Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "openziti", "product": "zrok", "versions": [{"status": "affected", "version": "< 2.0.1"}]}]}], "published": "2026-04-17T21:16:34.997", "references": [{"url": "https://github.com/openziti/zrok/releases/tag/v2.0.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openziti/zrok/security/advisories/GHSA-4fxq-2x3x-6xqx", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template (which performs no HTML escaping) instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the attacker-controlled refreshInterval query parameter verbatim into an error message when time.ParseDuration fails, and render that error unescaped into HTML. An attacker can deliver a crafted login URL to a victim; after the victim completes the GitHub OAuth flow, the callback page executes arbitrary JavaScript in the OAuth server's origin. Version 2.0.1 patches the issue."}, {"lang": "es", "value": "zrok es un software para compartir servicios web, archivos y recursos de red. Antes de la versi\u00f3n 2.0.1, el motor de plantillas proxyUi utiliza text/template de Go (que no realiza escape de HTML) en lugar de html/template. Los manejadores de callback de GitHub OAuth tanto en publicProxy como en dynamicProxy incrustan el par\u00e1metro de consulta refreshInterval controlado por el atacante textualmente en un mensaje de error cuando time.ParseDuration falla, y renderizan ese error sin escape en HTML. Un atacante puede entregar una URL de inicio de sesi\u00f3n manipulada a una v\u00edctima; despu\u00e9s de que la v\u00edctima completa el flujo de GitHub OAuth, la p\u00e1gina de callback ejecuta JavaScript arbitrario en el origen del servidor OAuth. La versi\u00f3n 2.0.1 corrige el problema."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70C6F018-6D34-4A75-A49D-A795B0A5B056", "versionEndExcluding": "2.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}