{"id":"CVE-2026-39379","kind":"vulnerability","aliases":["CVE-2026-39379"],"related":[],"title":"GeoNetwork: crafted link runs JavaScript in logged-in admin's browser session","description":"GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.","summary":"GeoNetwork, a catalog application for spatial data, reflects attacker-controlled request content into an AngularJS error page without neutralizing it. An attacker who tricks a logged-in user, including an administrator, into opening a crafted link can get arbitrary JavaScript to run in that user's authenticated session.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geonetwork","java","package","self-hosted","spatial-data"],"not_affected_if":["fixed-version","no-browser-access"],"how_to_check":"- Check the installed GeoNetwork version from the application's about page or deployment metadata; affected versions are 3.0.0 up to but not including `4.2.15` and `4.4.10`\n- Confirm whether the instance is reachable by users who could be sent links","fix":"- GeoNetwork `4.2.15`\n- GeoNetwork `4.4.10`","status":"open","published_at":"2026-11-03T19:18:05+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","triaged_at":"2026-11-03T19:45:38+00:00","updated_at":"2026-11-03T19:45:38+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T19:45:38Z","model":"claude-haiku-5-5","output":{"fix":"- GeoNetwork `4.2.15`\n- GeoNetwork `4.4.10`","reach":"internet","title":"GeoNetwork: crafted link runs JavaScript in logged-in admin's browser session","impact":"high","summary":"GeoNetwork, a catalog application for spatial data, reflects attacker-controlled request content into an AngularJS error page without neutralizing it. An attacker who tricks a logged-in user, including an administrator, into opening a crafted link can get arbitrary JavaScript to run in that user's authenticated session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["geonetwork","self-hosted","java","spatial-data"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"script runs in victim's session; data disclosed or actions performed","analyst_note":"Confirm exploit details and whether the AngularJS sandbox-escape path is practical against the fixed releases; check the vendor advisory and release notes linked in the sources.","how_to_check":"- Check the installed GeoNetwork version from the application's about page or deployment metadata; affected versions are 3.0.0 up to but not including `4.2.15` and `4.4.10`\n- Confirm whether the instance is reachable by users who could be sent links","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","no-browser-access"],"who_is_affected":"GeoNetwork instances from 3.0.0 through the versions before 4.2.15 and 4.4.10 are exposed when a user with access opens a crafted link. Instances that are not web-reachable by users, or that are already on a fixed version, can skip it. Exposure depends on how users reach the catalog and whether administrators click links from outside.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4328,"output_tokens":643,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-39379':16A,19A '3.0.0':90C '4.2.15':92C,185C '4.4.10':94C,187C 'action':175C 'adequ':119C 'admin':10A 'administr':61B,134C 'angularj':44B,116C,148C,154C 'applic':32B,83C,117C 'arbitrari':69B,162C 'attack':38B,51B,110C,127C 'attacker-control':37B,109C 'authent':77B,168C 'browser':12A,169C 'catalog':31B,82C 'caus':103C 'combin':151C 'content':41B,113C 'control':39B,111C 'craft':2A,65B,138C 'cve':14A,17A 'data':28B,35B 'disclos':171C 'error':45B,105C 'escap':157C 'evalu':124C,145C 'execut':161C 'express':150C 'fix':182C 'geonetwork':1A,20B,29B,79C 'get':68B 'host':25B 'includ':59B,132C 'induc':129C 'inform':172C 'insid':114C 'issu':180C 'java':21B 'javascript':5A,70B,163C 'known':153C 'link':3A,66B,139C 'log':8A,56B 'logged-in':7A,55B 'manag':85C 'neutral':48B,120C 'nonexist':97C 'open':63B,136C 'packag':22B 'page':46B,106C 'perform':174C 'referenc':87C 'reflect':36B,108C,142C 'remot':126C 'request':40B,95C,112C 'resourc':88C 'run':4A,72B 'sandbox':156C 'sandbox-escap':155C 'self':24B 'self-host':23B 'servic':100C 'session':13A,78B,170C 'spatial':27B,34B,86C 'spatial-data':26B 'techniqu':158C 'templat':123C,149C 'trick':53B 'unauthor':99C 'url':101C 'user':58B,75B 'valu':143C 'version':184C 'victim':131C,166C,178C 'without':47B,118C","nicknames":[],"mitigations":[],"who_affected":"GeoNetwork instances from 3.0.0 through the versions before 4.2.15 and 4.4.10 are exposed when a user with access opens a crafted link. Instances that are not web-reachable by users, or that are already on a fixed version, can skip it. Exposure depends on how users reach the catalog and whether administrators click links from outside.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["geonetwork","high","java","package","selfhosted","spatialdata"],"campaign_type":null,"first_public_at":"2026-07-01T11:05:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-39379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39379","severity":null,"published_at":"2026-11-03T19:18:05+00:00","modified_at":"2026-11-03T19:18:05+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","fetched_at":"2026-11-03T19:44:52+00:00","note":null}],"documents":[{"id":60191,"url":"https://github.com/geonetwork/core-geonetwork/commit/5cacdfaa6db88ef6787495b496a0871c0058b7f4","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60192,"url":"https://github.com/geonetwork/core-geonetwork/commit/dd99c2ffb642f89b8bf72bafd04d824c9fc0d0ef","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60193,"url":"https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.15","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60194,"url":"https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.10","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60195,"url":"https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2v4m-fw6c-g78f","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T11:05:50+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}