Read the docs
TI-2026-36346 Aliases CVE-2026-49131GHSA-2wfc-8j3p-p6cp

OPNsense < 26.1.9 Stored XSS via Firewall Rule Description Field

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via the filter API endpoint. The unsanitized description value is persisted and later rendered through the default cell formatter in opnsense_bootgrid.js, which assigns raw cell content to innerHTML, causing injected scripts to execute in the browser of any authenticated user who views the Firewall Rules page, enabling session hijacking or credential theft.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00289 21st percentileScored 2026-11-07
Fix Fixed OPNsense (Deciso B.V.): 26.1.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Deciso B.V.OPNsensebefore 26.1.926.1.9Patch availableCNA
  • OPNsense VendorDeciso B.V. Affected before 26.1.9 Fixed in 26.1.9 Patch available CNA

Remediation

  • Fix · CNA OPNsense (Deciso B.V.) Fixed in 26.1.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Deciso B.V. OPNsense 26.1.9

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-36347 OPNsense < 26.1.9 Stored XSS via Certificate Description FieldPriority LOW 22
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49131
  2. 2026-10-03 Alias added: GHSA-2wfc-8j3p-p6cp

References

Patch 1

Other 1

  • TI-2026-36347 OPNsense < 26.1.9 Stored XSS via Certificate Description Field CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences