CVE-2026-23929: Prototype Pollution Leading to XSS Vulnerability

CVE-2026-23929 Overview

CVE-2026-23929 is a prototype pollution vulnerability in the searchParamsToObject() function that results in persistent cross-site scripting (XSS) in the Maps feature. The function processes URL parameters without filtering dangerous properties such as __proto__. When combined with jQuery element creation that traverses the prototype chain, an authenticated attacker can inject script content that persists in the application state. The issue is tracked in the Zabbix issue tracker as ZBX-28068 and is classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes.

Critical Impact
An authenticated attacker can craft a URL that pollutes the JavaScript prototype chain and triggers stored XSS in the Maps interface, enabling session hijacking and unauthorized actions in the victim's browser context.

Affected Products

Zabbix (per issue tracker reference ZBX-28068)
Specific affected versions: Not Available in NVD data
Refer to the Zabbix Issue Tracker: ZBX-28068 for version details

Discovery Timeline

2026-08-18 - CVE-2026-23929 published to the National Vulnerability Database (NVD)
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-23929

Vulnerability Analysis

The defect resides in the client-side searchParamsToObject() helper, which converts URL query parameters into a JavaScript object. The function iterates over query keys and assigns their values directly onto an object without filtering reserved property names such as __proto__, constructor, or prototype. An attacker who controls the query string can therefore modify Object.prototype, causing polluted properties to appear on every object in the runtime.

The pollution becomes exploitable when jQuery constructs DOM elements using object literals whose property lookups traverse the prototype chain. Attributes such as event handlers or inline scripts inherited from the polluted prototype are attached to newly created elements, producing script execution in the Maps view. Because the polluted state can be reached through saved map configurations and shared links, the XSS behaves as a persistent (stored) vector rather than a purely reflected one.

Root Cause

The root cause is missing key sanitization during URL parameter deserialization, aligning with [CWE-1321]. Property names originating from untrusted input are written to an object created with an unsafe prototype (for example, {} rather than Object.create(null)), allowing modification of Object.prototype. The downstream jQuery element factory then trusts inherited properties, providing the sink required to convert prototype pollution into script execution.

Attack Vector

Exploitation requires network access to the Zabbix web frontend and an authenticated session with permissions to view the Maps feature. The attacker crafts a URL containing a payload such as ?__proto__[onerror]=<attacker JS> and induces a victim to open it. When the Maps page renders, jQuery reads the inherited property while creating an element, executing the attacker-controlled JavaScript in the victim's authenticated context. See the Zabbix Issue Tracker: ZBX-28068 for vendor technical details.

Detection Methods for CVE-2026-23929

Indicators of Compromise

HTTP requests to Zabbix frontend URLs containing __proto__, constructor, or prototype as query parameter names or nested keys
Access log entries referencing Maps endpoints with URL-encoded variants such as %5F%5Fproto%5F%5F or constructor[prototype]
Unexpected outbound requests originating from authenticated Zabbix user sessions after Maps navigation
Modifications to shared map configurations that contain script fragments or unusual attribute names

Detection Strategies

Inspect web server and reverse proxy logs for query strings that include prototype-pollution key patterns and correlate them with authenticated Zabbix sessions
Deploy web application firewall (WAF) rules that flag or block requests containing __proto__, constructor.prototype, or prototype[ inside query and body parameters
Review browser Content Security Policy (CSP) violation reports for inline script and event handler violations on Maps pages

Monitoring Recommendations

Monitor authentication and audit logs for anomalous administrative actions performed shortly after Maps page views
Alert on new or modified map elements that contain JavaScript URI schemes, on* event attributes, or encoded HTML in labels
Track session token reuse from geographically or temporally implausible sources following exposure to crafted Maps URLs

How to Mitigate CVE-2026-23929

Immediate Actions Required

Apply the vendor fix referenced in the Zabbix Issue Tracker: ZBX-28068 as soon as a patched build is available for your deployment channel
Restrict access to the Zabbix frontend to trusted networks and require multi-factor authentication for accounts with Maps permissions
Review recently created or modified map objects for suspicious labels, URLs, and inline script content, and revert unauthorized changes

Patch Information

Refer to Zabbix issue ZBX-28068 for the authoritative patch. The fix is expected to sanitize URL parameter keys before assignment, reject reserved property names such as __proto__ and constructor, and use prototype-less objects (Object.create(null)) for parameter storage. Confirm the fixed version against your installed release before scheduling deployment.

Workarounds

Deploy WAF or reverse proxy rules that reject query strings containing __proto__, constructor[, or prototype[ before requests reach the Zabbix frontend
Enforce a strict Content Security Policy that disallows inline scripts and inline event handlers on Zabbix frontend pages to limit script execution sinks
Limit Maps and URL-sharing permissions to a minimal set of trusted operators until a patched build is deployed

bash

# Example NGINX rule to block prototype pollution patterns in query strings
if ($args ~* "(^|&)(__proto__|constructor\[prototype\]|prototype\[)") {
    return 400;
}