---
id: "CVE-2026-39379"
kind: "vulnerability"
aliases: ["CVE-2026-39379"]
title: "GeoNetwork: crafted link runs JavaScript in logged-in admin's browser session"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["geonetwork", "java", "package", "self-hosted", "spatial-data"]
not_affected_if: ["fixed-version", "no-browser-access"]
published_at: "2026-11-03T19:18:05+00:00"
first_seen_at: "2026-11-03T19:44:52+00:00"
updated_at: "2026-11-03T19:45:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39379", "first_seen_at": "2026-11-03T19:44:52+00:00"}]
---

# GeoNetwork: crafted link runs JavaScript in logged-in admin's browser session

GeoNetwork, a catalog application for spatial data, reflects attacker-controlled request content into an AngularJS error page without neutralizing it. An attacker who tricks a logged-in user, including an administrator, into opening a crafted link can get arbitrary JavaScript to run in that user's authenticated session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GeoNetwork version from the application's about page or deployment metadata; affected versions are 3.0.0 up to but not including `4.2.15` and `4.4.10`
- Confirm whether the instance is reachable by users who could be sent links

## Fix

- GeoNetwork `4.2.15`
- GeoNetwork `4.4.10`

## Timeline

- 2026-11-03T19:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-39379

## Documents

- [advisory] Vendor advisory: github.com https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2v4m-fw6c-g78f
- [fix] Patch: github.com https://github.com/geonetwork/core-geonetwork/commit/5cacdfaa6db88ef6787495b496a0871c0058b7f4
- [fix] Patch: github.com https://github.com/geonetwork/core-geonetwork/commit/dd99c2ffb642f89b8bf72bafd04d824c9fc0d0ef
- [fix] Release notes: github.com https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.15
- [fix] Release notes: github.com https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.10

## From the sources

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_