CVE-2026-34417: OSCAL-GUI Reflected XSS Vulnerability

CVE-2026-34417 Overview

CVE-2026-34417 is a reflected cross-site scripting (XSS) vulnerability in OSCAL-GUI, a PHP-based interface for working with the Open Security Controls Assessment Language (OSCAL) framework. The flaw resides in oscal-forms.php, where the project request parameter is URL-decoded and reflected into the HTML response without sanitization or output encoding. Unauthenticated attackers can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser session. The issue is classified under [CWE-79] for improper neutralization of input during web page generation.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL, enabling session theft, credential harvesting, and client-side action hijacking.

Affected Products

OSCAL-GUI (PHP implementation)
oscal-forms.php endpoint
oscal-functions.php (root cause location)

Discovery Timeline

2026-06-09 - CVE-2026-34417 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-34417

Vulnerability Analysis

The vulnerability is a textbook reflected XSS that arises from missing output encoding on a user-controlled query parameter. When a request reaches oscal-forms.php, the application reads the project parameter from the HTTP request and passes it into backend logic implemented in oscal-functions.php. The parameter value is URL-decoded and assigned to the project_id variable with no sanitization, validation, or allowlisting applied. If the supplied project identifier does not match an existing project, the code path generates an error message through the Messages() helper function. That helper concatenates the attacker-controlled string directly into the HTML response body and returns it to the browser without HTML entity encoding. Because OSCAL-GUI does not require authentication for this endpoint, exploitation is trivial and requires only that a victim click a malicious link.

Root Cause

The root cause is the absence of contextual output encoding when assembling the error response. The Messages() function trusts that upstream code has sanitized inputs, while oscal-functions.php treats the decoded project parameter as a safe scalar value. Neither layer applies htmlspecialchars() or an equivalent encoder before concatenation, allowing raw HTML and <script> tags supplied by an attacker to be rendered as part of the page.

Attack Vector

Exploitation is delivered over the network and requires user interaction. An attacker constructs a URL pointing to the OSCAL-GUI deployment with a crafted project parameter containing JavaScript payload markup. The attacker then distributes the link through phishing email, chat messages, or a malicious site. When a victim with an active OSCAL-GUI session visits the link, the injected script executes in the origin of the application. The attacker can steal session cookies, perform actions on behalf of the victim, deface the interface, or pivot to additional client-side attacks. Refer to the VulnCheck Security Advisory and the GitHub Gist Security Resource for proof-of-concept details.

Detection Methods for CVE-2026-34417

Indicators of Compromise

HTTP GET or POST requests to oscal-forms.php containing <script>, onerror=, onload=, or javascript: substrings in the project parameter.
URL-encoded XSS payloads such as %3Cscript%3E or %3Cimg%20src%3Dx%20onerror%3D targeting the project parameter.
Web server access logs showing reflected response bodies that echo unusual project parameter values.

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for known XSS signatures applied to requests targeting oscal-forms.php.
Correlate response bodies with request parameters to identify reflection of attacker-controlled markup into HTML output.
Hunt for unusual outbound requests from user browsers to attacker-controlled domains shortly after they accessed the OSCAL-GUI application.

Monitoring Recommendations

Enable verbose access logging on the web server hosting OSCAL-GUI and retain logs for forensic review.
Deploy Content Security Policy (CSP) reporting endpoints to capture inline script execution attempts.
Alert on referrer chains where users arrive at oscal-forms.php from external phishing-style domains.

How to Mitigate CVE-2026-34417

Immediate Actions Required

Restrict network access to OSCAL-GUI instances to trusted users and networks until a patched version is deployed.
Apply a WAF rule that blocks or sanitizes the project parameter when it contains HTML control characters such as <, >, ", or '.
Educate OSCAL-GUI users about phishing links that target the application and instruct them not to click unverified URLs.

Patch Information

No official vendor patch is referenced in the NVD entry at the time of publication. Monitor the VulnCheck Security Advisory and the OSCAL-GUI source repository for fix commits. A correct remediation must apply HTML entity encoding to the project_id value before it is concatenated inside the Messages() output, and should additionally validate the parameter against an expected project identifier format.

Workarounds

Place OSCAL-GUI behind an authenticating reverse proxy so unauthenticated requests cannot reach oscal-forms.php.
Deploy a strict Content Security Policy that disallows inline script execution to limit the impact of reflected payloads.
Add a server-side input filter that rejects requests where the project parameter contains characters outside an allowlist of alphanumerics, hyphens, and underscores.

bash

# Example NGINX rule to drop requests with HTML metacharacters in the project parameter
if ($arg_project ~* "[<>\"']|script|onerror|onload") {
    return 400;
}