https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 01:17:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-291889 EUVD-2026-291889 https://cve.radiocsirt.org/vuln/euvd-2026-291889 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40302 <p>zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go&#39;s text/template (which performs no HTML escaping) instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the attacker-controlled refreshInterval query parameter verbatim into an error message when time.ParseDuration fails, and render that error unescaped into HTML. An attacker can deliver a crafted login URL to a victim; after the victim completes the GitHub OAuth flow, the callback page executes arbitrary JavaScript in the OAuth server&#39;s origin. Version 2.0.1 patches the issue.</p> <p>zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go&#39;s text/template (which performs no HTML escaping) instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the attacker-controlled refreshInterval query parameter verbatim into an error message when time.ParseDuration fails, and render that error unescaped into HTML. An attacker can deliver a crafted login URL to a victim; after the victim completes the GitHub OAuth flow, the callback page executes arbitrary JavaScript in the OAuth server&#39;s origin. Version 2.0.1 patches the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40302 https://cve.radiocsirt.org/vuln/ghsa-4fxq-2x3x-6xqx <p><strong>Affected:</strong> Go: github.com/openziti/zrok, Go: github.com/openziti/zrok/v2</p> <p>**Summary** The proxyUi template engine uses Go&#39;s text/template (which performs no HTML escaping) instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the attacker-controlled refreshInterval query parameter verbatim into an error message when time.ParseDuration fails, and render that error unescaped into HTML. An attacker can deliver a crafted login URL to a victim; after the victim completes the GitHub OAuth flow, the callback page executes arbitrary JavaScript in the OAuth server&#39;s origin.</p> <p>- Attack Vector: Network — the attack is delivered as a crafted URL over the internet. - Attack Complexity: Low — no race conditions or special environment prerequisites. - Privileges Required: None — the attacker needs no account on the zrok instance. - User Interaction: Required — the victim must click the crafted link and complete the GitHub OAuth flow. - Scope: Changed — the injected script executes in the OAuth server&#39;s origin, not the victim&#39;s share origin. - Confidentiality Impact: Low — the script runs in the OAuth server origin after a failed flow; no session cookie is set at this point, limiting what can be exfiltrated to what is visible in the DOM and what can be requested from the OAuth server. - Integrity Impact: Low — the script can initiate new OAuth flows or submit forms on behalf of the victim in the OAuth server origin. - Availability Impact: None.</p> <p>**Affected Components**</p> <p>- endpoints/proxyUi/template.go — init() / Wr…</p> <p><strong>Affected:</strong> Go: github.com/openziti/zrok, Go: github.com/openziti/zrok/v2</p> <p>**Summary** The proxyUi template engine uses Go&#39;s text/template (which performs no HTML escaping) instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the attacker-controlled refreshInterval query parameter verbatim into an error message when time.ParseDuration fails, and render that error unescaped into HTML. An attacker can deliver a crafted login URL to a victim; after the victim completes the GitHub OAuth flow, the callback page executes arbitrary JavaScript in the OAuth server&#39;s origin.</p> <p>- Attack Vector: Network — the attack is delivered as a crafted URL over the internet. - Attack Complexity: Low — no race conditions or special environment prerequisites. - Privileges Required: None — the attacker needs no account on the zrok instance. - User Interaction: Required — the victim must click the crafted link and complete the GitHub OAuth flow. - Scope: Changed — the injected script executes in the OAuth server&#39;s origin, not the victim&#39;s share origin. - Confidentiality Impact: Low — the script runs in the OAuth server origin after a failed flow; no session cookie is set at this point, limiting what can be exfiltrated to what is visible in the DOM and what can be requested from the OAuth server. - Integrity Impact: Low — the script can initiate new OAuth flows or submit forms on behalf of the victim in the OAuth server origin. - Availability Impact: None.</p> <p>**Affected Components**</p> <p>- endpoints/proxyUi/template.go — init() / Wr…</p> https://cve.radiocsirt.org/vuln/ghsa-4fxq-2x3x-6xqx