CVE-2026-41200

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41200", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-18T02:51:52.974Z", "datePublished": "2026-04-23T00:40:23.187Z", "dateUpdated": "2026-04-23T13:59:46.539Z"}, "containers": {"cna": {"title": "STIG Manager has reflected XSS vulnerability in the Web App", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/NUWCDIVNPT/stig-manager/security/advisories/GHSA-wg33-j3rv-jq72", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/NUWCDIVNPT/stig-manager/security/advisories/GHSA-wg33-j3rv-jq72"}], "affected": [{"vendor": "NUWCDIVNPT", "product": "stig-manager", "versions": [{"version": ">= 1.5.10, < 1.6.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-23T00:40:23.187Z"}, "descriptions": [{"lang": "en", "value": "STIG Manager is an API and web client for managing Security Technical Implementation Guides (STIG) assessments of Information Systems. Versions 1.5.10 through 1.6.7 have a reflected Cross-Site Scripting (XSS) vulnerability in the OIDC authentication error handling code in `src/init.js` and `public/reauth.html`. During the OIDC redirect flow, the `error` and `error_description` query parameters returned by the OIDC provider are written directly to the DOM via `innerHTML` without HTML escaping. An attacker who can craft a malicious redirect URL and convince a user to follow it can execute arbitrary JavaScript in the application's origin context. The vulnerability is most severe when the targeted user has an active STIG Manager session running in another browser tab \u2014 injected code executes in the same origin and can communicate with the SharedWorker managing the active access token, enabling authenticated API requests on behalf of the victim including reading and modifying collection data. The vulnerability is patched in version 1.6.8. There is no workaround short of upgrading. Deployments behind a web application firewall that filters reflected XSS payloads in query parameters may have partial mitigation, but this is not a substitute for patching."}], "source": {"advisory": "GHSA-wg33-j3rv-jq72", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-23T13:59:38.322359Z", "id": "CVE-2026-41200", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T13:59:46.539Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41200", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-23T13:59:38.322359Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T13:59:42.561Z"}}], "cna": {"title": "STIG Manager has reflected XSS vulnerability in the Web App", "source": {"advisory": "GHSA-wg33-j3rv-jq72", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "NUWCDIVNPT", "product": "stig-manager", "versions": [{"status": "affected", "version": ">= 1.5.10, < 1.6.8"}]}], "references": [{"url": "https://github.com/NUWCDIVNPT/stig-manager/security/advisories/GHSA-wg33-j3rv-jq72", "name": "https://github.com/NUWCDIVNPT/stig-manager/security/advisories/GHSA-wg33-j3rv-jq72", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "STIG Manager is an API and web client for managing Security Technical Implementation Guides (STIG) assessments of Information Systems. Versions 1.5.10 through 1.6.7 have a reflected Cross-Site Scripting (XSS) vulnerability in the OIDC authentication error handling code in `src/init.js` and `public/reauth.html`. During the OIDC redirect flow, the `error` and `error_description` query parameters returned by the OIDC provider are written directly to the DOM via `innerHTML` without HTML escaping. An attacker who can craft a malicious redirect URL and convince a user to follow it can execute arbitrary JavaScript in the application's origin context. The vulnerability is most severe when the targeted user has an active STIG Manager session running in another browser tab \u2014 injected code executes in the same origin and can communicate with the SharedWorker managing the active access token, enabling authenticated API requests on behalf of the victim including reading and modifying collection data. The vulnerability is patched in version 1.6.8. There is no workaround short of upgrading. Deployments behind a web application firewall that filters reflected XSS payloads in query parameters may have partial mitigation, but this is not a substitute for patching."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-23T00:40:23.187Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41200", "state": "PUBLISHED", "dateUpdated": "2026-04-23T13:59:46.539Z", "dateReserved": "2026-04-18T02:51:52.974Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-23T00:40:23.187Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "stig-manager", "vendor": "NUWCDIVNPT", "versions": [{"status": "affected", "version": ">= 1.5.10, < 1.6.8"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "STIG Manager is an API and web client for managing Security Technical Implementation Guides (STIG) assessments of Information Systems. Versions 1.5.10 through 1.6.7 have a reflected Cross-Site Scripting (XSS) vulnerability in the OIDC authentication error handling code in `src/init.js` and `public/reauth.html`. During the OIDC redirect flow, the `error` and `error_description` query parameters returned by the OIDC provider are written directly to the DOM via `innerHTML` without HTML escaping. An attacker who can craft a malicious redirect URL and convince a user to follow it can execute arbitrary JavaScript in the application's origin context. The vulnerability is most severe when the targeted user has an active STIG Manager session running in another browser tab \u2014 injected code executes in the same origin and can communicate with the SharedWorker managing the active access token, enabling authenticated API requests on behalf of the victim including reading and modifying collection data. The vulnerability is patched in version 1.6.8. There is no workaround short of upgrading. Deployments behind a web application firewall that filters reflected XSS payloads in query parameters may have partial mitigation, but this is not a substitute for patching."}, {"lang": "es", "value": "STIG Manager es una API y un cliente web para gestionar evaluaciones de las Gu\u00edas de Implementaci\u00f3n T\u00e9cnica de Seguridad (STIG) de Sistemas de Informaci\u00f3n. Las versiones 1.5.10 hasta 1.6.7 tienen una vulnerabilidad de cross-site scripting (XSS) reflejado en el c\u00f3digo de manejo de errores de autenticaci\u00f3n OIDC en \u2019src/init.js\u2019 y \u2019public/reauth.html\u2019. Durante el flujo de redirecci\u00f3n OIDC, los par\u00e1metros de consulta \u2019error\u2019 y \u2019error_description\u2019 devueltos por el proveedor OIDC se escriben directamente en el DOM a trav\u00e9s de \u2019innerHTML\u2019 sin escape HTML. Un atacante que puede crear una URL de redirecci\u00f3n maliciosa y convencer a un usuario para que la siga puede ejecutar JavaScript arbitrario en el contexto de origen de la aplicaci\u00f3n. La vulnerabilidad es m\u00e1s grave cuando el usuario objetivo tiene una sesi\u00f3n activa de STIG Manager ejecut\u00e1ndose en otra pesta\u00f1a del navegador - el c\u00f3digo inyectado se ejecuta en el mismo origen y puede comunicarse con el SharedWorker que gestiona el token de acceso activo, lo que permite solicitudes de API autenticadas en nombre de la v\u00edctima, incluyendo la lectura y modificaci\u00f3n de datos de la colecci\u00f3n. La vulnerabilidad est\u00e1 parcheada en la versi\u00f3n 1.6.8. No hay soluci\u00f3n alternativa aparte de actualizar. Las implementaciones detr\u00e1s de un cortafuegos de aplicaciones web que filtra cargas \u00fatiles de XSS reflejado en los par\u00e1metros de consulta pueden tener una mitigaci\u00f3n parcial, pero esto no sustituye el parcheo."}], "id": "CVE-2026-41200", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41200", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-23T13:59:38.322359Z", "version": "2.0.3"}}]}, "published": "2026-04-23T02:16:18.333", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/NUWCDIVNPT/stig-manager/security/advisories/GHSA-wg33-j3rv-jq72"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.5.10,1.6.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "stig-manager", "source": "cna", "vendor": "NUWCDIVNPT"}, "product": "stig-manager", "vendor": "nuwcdivnpt"}], "analysis": {"en": {"generated_at": "2026-04-28T15:02:47.830973+00:00", "value": {"mitigation_remediation": ["Upgrade STIG Manager to version 1.6.8 or later to eliminate the reflected XSS vulnerability.", "If patching cannot be performed immediately, configure the web application firewall to reject or sanitize reflected XSS payloads in query parameters, noting that this is only partial mitigation.", "Apply strict input validation to the error and error_description parameters, ensuring they are properly escaped before rendering, to block future injection attempts."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Versions of STIG Manager from 1.5.10 through 1.6.7 are affected. The affected vendor is NUWCDIVNPT and the product name is Stan Manager. The vulnerability is fixed in STIG Manager 1.6.8 and later; there is no known broader version impact beyond the stated range.", "description_and_impact": "STIG Manager, a web client for managing Security Technical Implementation Guides, contains a reflected Cross\u2011Site Scripting flaw that allows malicious script to be injected through the OIDC authentication error handling code in src/init.js and public/reauth.html. The vulnerability occurs when an OIDC provider returns the error and error_description parameters, which are written directly to the DOM via innerHTML without escaping. An attacker can craft a malicious redirect URL and entice a user to visit it, causing arbitrary JavaScript to run in the same origin as the application. With a target user holding an active STIG Manager session in another tab, the injected code can communicate with the SharedWorker managing the access token, enabling the attacker to perform authenticated API requests on behalf of the victim, including reading and modifying collection data.", "risk_and_exploitability": "The CVSS score of 8.5 indicates high severity. The EPSS score of less than 1% suggests exploitation is unlikely at present, but the vulnerability is not listed in the CISA KEV catalog. The attack requires a user to follow a crafted OIDC redirect URL containing a malicious error parameter; thus, it is a credential\u2011less or social\u2011engineering attack scenario that hinges on user interaction. If successful, the attacker gains Remote Code Execution capabilities within the application\u2019s origin, allowing credential theft and data manipulation, with a potentially significant impact on confidentiality and integrity of STIG data."}}}}, "created": "2026-04-28T09:26:32.305776+00:00", "updated": "2026-04-28T15:15:34.199049+00:00", "vendors": ["nuwcdivnpt", "nuwcdivnpt$PRODUCT$stig-manager"]}