{"id":"EUVD-2026-23547","enisaUuid":"2b545c6b-2df5-3638-8a78-8437ac693ab0","description":"zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go\u0027s text/template (which performs no HTML escaping) instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the attacker-controlled refreshInterval query parameter verbatim into an error message when time.ParseDuration fails, and render that error unescaped into HTML. An attacker can deliver a crafted login URL to a victim; after the victim completes the GitHub OAuth flow, the callback page executes arbitrary JavaScript in the OAuth server\u0027s origin. Version 2.0.1 patches the issue.","datePublished":"Apr 17, 2026, 8:56:08 PM","dateUpdated":"Apr 18, 2026, 3:07:10 AM","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/openziti/zrok/security/advisories/GHSA-4fxq-2x3x-6xqx\nhttps://github.com/openziti/zrok/releases/tag/v2.0.1\n","aliases":"CVE-2026-40302\nGHSA-4fxq-2x3x-6xqx\n","assigner":"GitHub_M","epss":0.21,"enisaIdProduct":[{"id":"fb6cfe31-5f12-3169-907c-1aefd41f306f","product":{"name":"zrok","vendor":{"name":"openziti"}},"product_version":"\u003c 2.0.1"}],"enisaIdVendor":[{"id":"5998c7b7-265d-352b-8624-e1931ecc5350","vendor":{"name":"openziti"}}],"enisaIdVulnerability":[{"id":"ae18aa67-84aa-360d-a601-1037e1b4ac94","vulnerability":{"id":"GHSA-4fxq-2x3x-6xqx","description":"zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering","datePublished":"Apr 16, 2026, 9:08:55 PM","dateUpdated":"Apr 24, 2026, 8:48:45 PM","baseScore":0.0,"references":"https://github.com/openziti/zrok/security/advisories/GHSA-4fxq-2x3x-6xqx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40302\nhttps://github.com/openziti/zrok\nhttps://github.com/openziti/zrok/releases/tag/v2.0.1\n","enisa_id":"EUVD-2026-23547\n","aliases":"CVE-2026-40302\nGHSA-4fxq-2x3x-6xqx\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f6927151-8ce9-3ad3-be4d-60a09c7e8ca3","vulnerability":{"id":"CVE-2026-40302","description":"zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go\u0027s text/template (which performs no HTML escaping) instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the attacker-controlled refreshInterval query parameter verbatim into an error message when time.ParseDuration fails, and render that error unescaped into HTML. An attacker can deliver a crafted login URL to a victim; after the victim completes the GitHub OAuth flow, the callback page executes arbitrary JavaScript in the OAuth server\u0027s origin. Version 2.0.1 patches the issue.","datePublished":"Apr 17, 2026, 8:56:08 PM","dateUpdated":"Apr 18, 2026, 3:07:10 AM","status":"PUBLISHED","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/openziti/zrok/security/advisories/GHSA-4fxq-2x3x-6xqx\nhttps://github.com/openziti/zrok/releases/tag/v2.0.1\n","enisa_id":"EUVD-2026-23547\n","assigner":"GitHub_M","epss":0.21,"dataProcessed":"Oct 30, 2026, 7:16:35 AM","vulnerabilityProduct":[{"id":"8500def0-67d2-3261-878a-749f5ed66afa","product":{"name":"zrok","vendor":{"name":"openziti"}},"product_version":"\u003c 2.0.1"}],"vulnerabilityVendor":[{"id":"72f40935-61a2-3d48-99b1-245b702fc3df","vendor":{"name":"openziti"}}]}}],"enisaIdAdvisory":[]}