CVE-2026-49131 Details
Description
OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via the filter API endpoint. The unsanitized description value is persisted and later rendered through the default cell formatter in opnsense_bootgrid.js, which assigns raw cell content to innerHTML, causing injected scripts to execute in the browser of any authenticated user who views the Firewall Rules page, enabling session hijacking or credential theft.
A stored cross-site scripting vulnerability has been identified in OPNsense versions prior to 26.1.9. This vulnerability allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript. The injection occurs by embedding payloads in the firewall rule description field via the filter API endpoint. The unsanitized description is then persisted and rendered through the default cell formatter in 'opnsense_bootgrid.js', which uses 'innerHTML' to display the content. This flaw enables injected scripts to execute in the browsers of authenticated users viewing the Firewall Rules page, potentially leading to session hijacking or credential theft.
Users can upgrade to OPNsense version 26.1.11 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |