Reflected XSS in GeoNetwork through AngularJS template injection
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution, Cross-site scripting
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336 and CWE-79.
Summary
GeoNetwork from 3.0.0 through 3.12.12, from 4.0.0-alpha.1 through 4.0.6, from 4.2.0 before 4.2.15, and from 4.4.0 before 4.4.10 reflects request content in an error page for a nonexistent or unauthorized service URL. The reflected value is not neutralized for AngularJS template evaluation (CWE-1336). A remote attacker can make a victim, including an administrator, open a crafted link to run the value as an AngularJS expression. With known AngularJS sandbox escapes, this can run JavaScript in the victim's authenticated session, disclose data, or act as the victim.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| geonetwork | core-geonetwork | 3.0.0 – 3.12.12; 4.0.0-alpha.1 – 4.0.6; 4.2.0 to before 4.2.15; 4.4.0 to before 4.4.10 | 4.2.15, 4.4.10 | Patch available | CNA |
| — | org.geonetwork-opensource:geonetwork (Maven) | 3.0.0 – 3.12.12 | — | No fix listed | GHSA-2v4m-fw6c-g78f |
| — | org.geonetwork-opensource:geonetwork (Maven) | 4.0.0-alpha.1 – 4.0.6 | — | No fix listed | GHSA-2v4m-fw6c-g78f |
| — | org.geonetwork-opensource:geonetwork (Maven) | 4.2.0 to before 4.2.15 | 4.2.15 | Patch available | GHSA-2v4m-fw6c-g78f |
| — | org.geonetwork-opensource:geonetwork (Maven) | 4.4.0 to before 4.4.10 | 4.4.10 | Patch available | GHSA-2v4m-fw6c-g78f |
- core-geonetwork Vendorgeonetwork Affected 3.0.0 – 3.12.12; 4.0.0-alpha.1 – 4.0.6; 4.2.0 to before 4.2.15; 4.4.0 to before 4.4.10 Fixed in 4.2.15, 4.4.10 Patch available CNA
- org.geonetwork-opensource:geonetwork (Maven) Vendor— Affected 3.0.0 – 3.12.12 Fixed in — No fix listed GHSA-2v4m-fw6c-g78f
- org.geonetwork-opensource:geonetwork (Maven) Vendor— Affected 4.0.0-alpha.1 – 4.0.6 Fixed in — No fix listed GHSA-2v4m-fw6c-g78f
- org.geonetwork-opensource:geonetwork (Maven) Vendor— Affected 4.2.0 to before 4.2.15 Fixed in 4.2.15 Patch available GHSA-2v4m-fw6c-g78f
- org.geonetwork-opensource:geonetwork (Maven) Vendor— Affected 4.4.0 to before 4.4.10 Fixed in 4.4.10 Patch available GHSA-2v4m-fw6c-g78f
Remediation
Upgrade core-geonetwork to 4.2.15 or 4.4.10, whichever matches the installed release. Upgrade the Maven package org.geonetwork-opensource:geonetwork to 4.2.15 for the 4.2.0 to before 4.2.15 range, or to 4.4.10 for the 4.4.0 to before 4.4.10 range. No fix is listed for the Maven package in the 3.0.0 through 3.12.12 or 4.0.0-alpha.1 through 4.0.6 ranges.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA core-geonetwork (geonetwork) Fixed in 4.2.15, 4.4.10
- Fix · GHSA-2v4m-fw6c-g78f org.geonetwork-opensource:geonetwork (Maven) Fixed in 4.2.15 Advisory →
- Fix · GHSA-2v4m-fw6c-g78f org.geonetwork-opensource:geonetwork (Maven) Fixed in 4.4.10 Advisory →
Timeline
- 2026-11-03 Threatist record created from CVE-2026-39379
- 2026-11-03 CISA SSVC decision points changed
- 2026-11-03 Priority changed: MEDIUM → LOW
References
Other 6
- https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2v4m-fw6c-g78f
- https://github.com/geonetwork/core-geonetwork/commit/5cacdfaa6db88ef6787495b496a0871c0058b7f4
- https://github.com/geonetwork/core-geonetwork/commit/dd99c2ffb642f89b8bf72bafd04d824c9fc0d0ef
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.15
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.10
- https://github.com/geonetwork/core-geonetwork
More geonetwork vulnerabilities
- TI-2026-45097 Unauthenticated file upload via missing authorization on formatter upload endpoint CVSS 3.1HIGH 8.6
- TI-2026-42016 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter CVSS 3.1CRITICAL 9.1
- TI-2022-26353 Geonetwork 4.2.0 - XML External Entity (XXE) CVSS 4.0HIGH 8.7
- TI-2026-40323 GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool CVSS 4.0HIGH 7.8
- TI-2026-84467 Access control bypass in GeoNetwork Elasticsearch search proxy CVSS 3.1HIGH 7.5
- TI-2006-05324 SQL injection vulnerability in GeoNetwork opensource before 2.0.3 allows remote attackers… CVSS 2.0HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences