/Vulnerability Library

GeoNetwork - Reflected Cross-Site Scripting

CVE-2026-57582
Verified

Description

GeoNetwork versions 4.4.5 through 4.4.11 are vulnerable to reflected cross-site scripting (XSS) in the public unauthenticated catalog search functionality. The uiconfig query parameter of the catalog.search endpoint is reflected into a JavaScript context without sufficient sanitization, allowing arbitrary JavaScript execution in a victim's browser.

Severity

High

CVSS Score

8.2

Affected Product

core-geonetwork

Published Date

September 1, 2026

Template Author

dhiyaneshdk

CVE-2026-57582.yaml
8.2Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVE ID:
cve-2026-57582
CWE ID:
cwe-79

References

https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-5pq9-ppfw-p83j

Remediation Steps

Upgrade GeoNetwork to version 4.4.12 or later.