Executive Summary

The CVE-2026-10173 vulnerability is a reflected Cross-Site Scripting (XSS) attack in Orthanc Explorer 2. It occurs because the application improperly handles the 'remote-source' URL query parameter by not sanitizing it before use. This unsanitized input is injected into a Vue.js internationalization translation string and rendered using 'v-html', which allows an attacker to execute arbitrary JavaScript code in the victim's browser.

An attacker can craft a malicious URL containing an XSS payload in the 'remote-source' parameter. When a victim accesses this URL, the payload executes without requiring authentication or prior access, making the attack easy to perform remotely.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to several serious impacts including session hijacking, unauthorized actions performed on behalf of the victim, exposure of sensitive medical data, and further client-side attacks.

Because no authentication or prior access is needed, attackers can easily use malicious URLs in shared environments such as emails or internal systems to compromise users.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious or malicious URLs containing the `remote-source` parameter with potentially harmful payloads. Since the vulnerability involves reflected Cross-Site Scripting (XSS) via the `remote-source` URL query parameter, detection can focus on identifying such crafted URLs being accessed or logged.

You can use network monitoring tools or web server logs to search for requests containing the `remote-source` parameter with suspicious content.

• Use grep or similar tools on web server logs to find requests with the `remote-source` parameter, for example: `grep -i 'remote-source=' /var/log/nginx/access.log`
• Use intrusion detection systems (IDS) or web application firewalls (WAF) to detect or block requests with suspicious scripts or encoded payloads in the `remote-source` parameter.
• Manually test the application by crafting URLs with XSS payloads in the `remote-source` parameter to see if the payload executes, indicating vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended immediate step to mitigate this vulnerability is to apply the official patch identified by commit 21f78ce5da668bf5233efcd1896ec7c6e3b22eae.

This patch upgrades the vue-i18n library and introduces sanitization of the `remote-source` input in the StudyList component, preventing the injection of malicious scripts.

Until the patch can be applied, consider implementing input validation or filtering on the `remote-source` parameter to block or sanitize suspicious inputs.

Additionally, use web application firewalls (WAF) to detect and block XSS attack attempts targeting this parameter.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows for reflected Cross-Site Scripting (XSS) attacks that can lead to session hijacking, unauthorized actions, and exposure of sensitive medical data.

Exposure of sensitive medical data through such attacks can negatively impact compliance with regulations like HIPAA, which mandates the protection of patient health information.

Similarly, GDPR requires protection of personal data and breach prevention; exploitation of this vulnerability could result in unauthorized data access or leakage, thus affecting GDPR compliance.

Therefore, until patched, this vulnerability poses a risk to maintaining compliance with standards that require safeguarding sensitive or personal data.

Useful 0 Not Useful 0