Read the docs
TI-2026-36347 Aliases CVE-2026-49132GHSA-7979-v6f7-5r6j

OPNsense < 26.1.9 Stored XSS via Certificate Description Field

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later rendered in the Dashboard Certificates widget through Certificates.js, which interpolates the raw value into HTML attribute and text content sinks without encoding, causing injected scripts to execute in the browser of any authenticated user who views the Dashboard, enabling session hijacking or credential theft.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00185 8th percentileScored 2026-11-07
Fix Fixed OPNsense (Deciso B.V.): 26.1.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Deciso B.V.OPNsensebefore 26.1.926.1.9Patch availableCNA
  • OPNsense VendorDeciso B.V. Affected before 26.1.9 Fixed in 26.1.9 Patch available CNA

Remediation

  • Fix · CNA OPNsense (Deciso B.V.) Fixed in 26.1.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Deciso B.V. OPNsense 26.1.9

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-36346 OPNsense < 26.1.9 Stored XSS via Firewall Rule Description FieldPriority LOW 23
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49132
  2. 2026-10-03 Alias added: GHSA-7979-v6f7-5r6j

References

Patch 1

Other 1

  • TI-2026-36346 OPNsense < 26.1.9 Stored XSS via Firewall Rule Description Field CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences