Vulnerability · Published Jun 9, 2026 · Assigned by VulnCheck

CVE-2026-34416OSCAL-GUI Reflected XSS via project parameter in oscal.php

Medium 6.1

In plain English

A medium-severity cross-site scripting in OSCAL-GUI from brian-ruf. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 90.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL containing unsanitized input that breaks out of the JavaScript string and HTML attribute context in the body onload event handler to execute arbitrary scripts when the link is visited by a victim.

Affected products (as reported)

Vendor	Product	Versions
brian-ruf	OSCAL-GUI	0 – through c989c4bd5a68f2621a81654e9250246539a28d5a

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://gist.github.com/cyberinforepo/5a8d369a005826b6b42bfeed9607c2dd technical-description, exploit
https://www.vulncheck.com/advisories/oscal-gui-reflected-xss-via-project-parameter-in-oscal-php third-party-advisory