CVE-2026-58205

Received Received - Intake

Reflected XSS in GRR Resource Management App

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-27

Last Modified

2026-10-27

Generated

2026-10-28

AI Q&A

2026-10-28

EPSS Evaluated

N/A

NVD

CVE-2026-58205

Affected Vendors & Products

Vendor	Product	Version / Range
JeromeDevome	GRR	< 4.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in GRR versions before 4.5.0. The maj.php file reflects the forcemaj parameter without proper escaping, allowing attackers to inject malicious JavaScript into URLs. When victims access these URLs, the script executes in their browser.

Detection Guidance

Check for accessible installation files like maj.php on your GRR server. Verify if the forcemaj parameter is reflected without proper escaping in URLs. Test by accessing URLs with crafted parameters to see if JavaScript executes.

Impact Analysis

An attacker could use this to perform phishing attacks, redirect users to malicious sites, steal cookies, or hijack active sessions. Since the authentication cookie lacks the HttpOnly flag, it is accessible to JavaScript, making session hijacking possible.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data through reflected XSS attacks, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Upgrade GRR to version 4.5.0 or later to fix the vulnerability. Remove any remaining installation files manually. Ensure authentication cookies are set with HttpOnly flag to prevent theft.

Hi! I’m here to help you understand CVE-2026-58205. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70