Live › vulnerability › CVE-2026-39379
GeoNetwork, a catalog application for spatial data, reflects attacker-controlled request content into an AngularJS error page without neutralizing it. An attacker who tricks a logged-in user, including an administrator, into opening a crafted link can get arbitrary JavaScript to run in that user's authenticated session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 19:44 UTC. All times on this page are UTC.
GeoNetwork instances from 3.0.0 through the versions before 4.2.15 and 4.4.10 are exposed when a user with access opens a crafted link. Instances that are not web-reachable by users, or that are already on a fixed version, can skip it. Exposure depends on how users reach the catalog and whether administrators click links from outside.
No product ranges from the sources yet.
4.2.15 and 4.4.104.2.154.4.10Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.
This page as .md · .json · in your agent: get_signal("CVE-2026-39379")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.