{"id":"CVE-2026-40302","sourceIdentifier":"security-advisories@github.com","published":"2026-04-17T21:16:34.997","lastModified":"2026-10-26T22:10:00.163","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template (which performs no HTML escaping) instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the attacker-controlled refreshInterval query parameter verbatim into an error message when time.ParseDuration fails, and render that error unescaped into HTML. An attacker can deliver a crafted login URL to a victim; after the victim completes the GitHub OAuth flow, the callback page executes arbitrary JavaScript in the OAuth server's origin. Version 2.0.1 patches the issue."},{"lang":"es","value":"zrok es un software para compartir servicios web, archivos y recursos de red. Antes de la versión 2.0.1, el motor de plantillas proxyUi utiliza text/template de Go (que no realiza escape de HTML) en lugar de html/template. Los manejadores de callback de GitHub OAuth tanto en publicProxy como en dynamicProxy incrustan el parámetro de consulta refreshInterval controlado por el atacante textualmente en un mensaje de error cuando time.ParseDuration falla, y renderizan ese error sin escape en HTML. Un atacante puede entregar una URL de inicio de sesión manipulada a una víctima; después de que la víctima completa el flujo de GitHub OAuth, la página de callback ejecuta JavaScript arbitrario en el origen del servidor OAuth. La versión 2.0.1 corrige el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"openziti","product":"zrok","versions":[{"version":"< 2.0.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-18T03:07:00.447331Z","id":"CVE-2026-40302","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.1","matchCriteriaId":"70C6F018-6D34-4A75-A49D-A795B0A5B056"}]}]}],"references":[{"url":"https://github.com/openziti/zrok/releases/tag/v2.0.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/openziti/zrok/security/advisories/GHSA-4fxq-2x3x-6xqx","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}