Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-73259
5.4 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Mongoose: Reflected XSS via decoded URI in directory listing render
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the decoded request URI into the title and h1 elements without HTML entity encoding. The resulting reflected cross-site scripting executes in the Mongoose origin and can expose session data or perform actions as the victim. This issue is fixed in version 7.22.
References
-
https://github.com/cesanta/mongoose/security/advisories/GHSA-9cwm-487w-h25w exploitx_refsource_CONFIRM
-
https://github.com/cesanta/mongoose/pull/3611 x_refsource_MISC
-
https://github.com/cesanta/mongoose/releases/tag/7.22 x_refsource_MISC
Affected products
mongoose
- ==< 7.22
Package maintainers
-
@wegank Weijia Wang <contact@weijia.wang>