CVE-2026-24037

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24037", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-20T22:30:11.776Z", "datePublished": "2026-01-22T03:31:37.305Z", "dateUpdated": "2026-01-22T12:36:02.772Z"}, "containers": {"cna": {"title": "Horilla HRM has XSS Bypass through Project Name", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-rqw5-fjm4-rgvm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-rqw5-fjm4-rgvm"}, {"name": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0"}], "affected": [{"vendor": "horilla-opensource", "product": "horilla", "versions": [{"version": ">= 1.4.0, < 1.5.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T03:31:37.305Z"}, "descriptions": [{"lang": "en", "value": "Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the has_xss() function attempts to block XSS by matching input against a set of regex patterns. However, the regexes are incomplete and context-agnostic, making them easy to bypass. Attackers are able to redirect users to malicious domains, run external JavaScript, and steal CSRF tokens that can be used to craft CSRF attacks against admins. This issue has been fixed in version 1.5.0."}], "source": {"advisory": "GHSA-rqw5-fjm4-rgvm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T12:35:41.669918Z", "id": "CVE-2026-24037", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T12:36:02.772Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24037", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T12:35:41.669918Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T12:35:58.155Z"}}], "cna": {"title": "Horilla HRM has XSS Bypass through Project Name", "source": {"advisory": "GHSA-rqw5-fjm4-rgvm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "horilla-opensource", "product": "horilla", "versions": [{"status": "affected", "version": ">= 1.4.0, < 1.5.0"}]}], "references": [{"url": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-rqw5-fjm4-rgvm", "name": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-rqw5-fjm4-rgvm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0", "name": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the has_xss() function attempts to block XSS by matching input against a set of regex patterns. However, the regexes are incomplete and context-agnostic, making them easy to bypass. Attackers are able to redirect users to malicious domains, run external JavaScript, and steal CSRF tokens that can be used to craft CSRF attacks against admins. This issue has been fixed in version 1.5.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T03:31:37.305Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24037", "state": "PUBLISHED", "dateUpdated": "2026-01-22T12:36:02.772Z", "dateReserved": "2026-01-20T22:30:11.776Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-22T03:31:37.305Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "horilla", "vendor": "horilla-opensource", "versions": [{"status": "affected", "version": ">= 1.4.0, < 1.5.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:horilla:horilla:1.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "55143854-C369-4CAA-B671-90EFC9170F64", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the has_xss() function attempts to block XSS by matching input against a set of regex patterns. However, the regexes are incomplete and context-agnostic, making them easy to bypass. Attackers are able to redirect users to malicious domains, run external JavaScript, and steal CSRF tokens that can be used to craft CSRF attacks against admins. This issue has been fixed in version 1.5.0."}, {"lang": "es", "value": "Horilla es un Sistema de Gesti\u00f3n de Recursos Humanos (HRMS) gratuito y de c\u00f3digo abierto. En la versi\u00f3n 1.4.0, la funci\u00f3n has_xss() intenta bloquear XSS comparando la entrada con un conjunto de patrones de expresiones regulares. Sin embargo, las expresiones regulares son incompletas y agn\u00f3sticas al contexto, lo que las hace f\u00e1ciles de eludir. Los atacantes pueden redirigir a los usuarios a dominios maliciosos, ejecutar JavaScript externo y robar tokens CSRF que pueden usarse para elaborar ataques CSRF contra administradores. Este problema ha sido solucionado en la versi\u00f3n 1.5.0."}], "id": "CVE-2026-24037", "lastModified": "2026-06-17T10:22:30.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24037", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T12:35:41.669918Z", "version": "2.0.3"}}]}, "published": "2026-01-22T04:15:59.743", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-rqw5-fjm4-rgvm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:26:47.771210+00:00", "value": {"mitigation_remediation": ["Upgrade Horilla HRM to version 1.5.0 or later to apply the vendor fix", "If an upgrade cannot be performed immediately, enforce server\u2011side validation that restricts project names to alphanumeric characters and a reasonable maximum length", "Apply proper output encoding or escaping to render any remaining script content harmless in all output contexts"], "summary": {"action": "Patch", "impact": "Cross\u2011site scripting via project name bypass"}, "threat_synthesis": {"affected_systems": "Horilla HRM installations running version 1.4.0 are affected. The security issue was addressed in version 1.5.0, so any deployment on 1.5.0 or later is not vulnerable.", "description_and_impact": "The flaw originates from an incomplete, context\u2011agnostic regular\u2011expression filter in the has_xss() function used by Horilla HRM version 1.4.0. Malicious input can be inserted into the project name field, allowing an attacker to redirect users, execute arbitrary JavaScript, and capture CSRF tokens that may later be used for further exploitation. This constitutes a classic cross\u2011site scripting vulnerability described by CWE\u201179.", "risk_and_exploitability": "The CVSS score of 4.8 categorizes the flaw as moderate, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically need to target users of the HRMS by submitting a crafted project name through the web interface, a common web\u2011application attack vector."}}}}, "created": "2026-01-22T10:08:15.106067+00:00", "updated": "2026-04-18T15:30:03.964895+00:00", "vendors": ["horilla", "horilla$PRODUCT$horilla"]}