Description

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browser.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-12T17:17:27.523Z",
  "pubdate": "2026-08-12T17:17:27.523Z",
  "executiveSummary": "Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a DOM-based cross-site scripting vulnerability located within jsonquery.js. This security flaw enables attackers to execute arbitrary JavaScript code within the context of a victim's browser session. The vulnerability stems from improper handling of data retrieved from stored fields, where unencoded JSON string values are directly injected into the Document Object Model without prior sanitization or context-aware encoding. The business and operational implications involve potential session hijacking, unauthorized administrative actions, and data exposure within enterprise monitoring environments. Successful exploitation requires an attacker to interact with vulnerable query mechanisms and induce a victim to process the malicious payload via their browser. Mitigation requires updating the affected Nagios Core and Nagios XI installations to the patched version releases.",
  "technicalDetails": "The vulnerability is classified as a DOM-based cross-site scripting flaw residing within the jsonquery.js component of the affected applications. The root cause of the vulnerability is the unsafe handling of dynamic data within client-side scripts. Specifically, unencoded JSON string values, originating from stored database fields or server responses, are retrieved and dynamically injected into the Document Object Model without undergoing rigorous input sanitization or output encoding.\nThe attack flow typically proceeds through the following sequence: First, an attacker injects malicious payload data into stored fields that are subsequently queried via the JSON query interface handled by jsonquery.js. Second, a victim initiates a request or interacts with a crafted query interface that returns the stored data containing the malicious string. Third, the client-side JavaScript script processes the JSON response and directly writes the unencoded string values into the DOM structure using unsafe sinks. Fourth, when the browser parses the updated DOM, the injected script executes within the security context of the victim's session, possessing access to session tokens, cookies, and authenticated application functionality.\nThe affected components are Nagios Core prior to version 4.5.14 and Nagios XI prior to version 2026R1.7, specifically focusing on the client-side script file jsonquery.js. Exploitation leverages network exposure associated with the web-based management interfaces of the monitoring platforms. Post-exploitation impact includes the execution of arbitrary JavaScript, potential compromise of monitoring system integrity, theft of session identifiers, and unauthorized actions performed with the privileges of the victimized user."
}