{"id":"CVE-2026-39379","published":"2026-11-03T19:18:05.733","lastModified":"2026-11-03T23:17:43.130","description":"GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.","cvssScore":7.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","cwes":["CWE-79","CWE-1336"],"vendors":[],"products":[],"references":[{"url":"https://github.com/geonetwork/core-geonetwork/commit/5cacdfaa6db88ef6787495b496a0871c0058b7f4","tags":[]},{"url":"https://github.com/geonetwork/core-geonetwork/commit/dd99c2ffb642f89b8bf72bafd04d824c9fc0d0ef","tags":[]},{"url":"https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.15","tags":[]},{"url":"https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.10","tags":[]},{"url":"https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2v4m-fw6c-g78f","tags":[]}],"exploitRefs":[{"url":"https://github.com/geonetwork/core-geonetwork/commit/5cacdfaa6db88ef6787495b496a0871c0058b7f4","tags":[]},{"url":"https://github.com/geonetwork/core-geonetwork/commit/dd99c2ffb642f89b8bf72bafd04d824c9fc0d0ef","tags":[]},{"url":"https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.15","tags":[]},{"url":"https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.10","tags":[]},{"url":"https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2v4m-fw6c-g78f","tags":[]}],"hasPoc":true,"ai":null}