GHSA-3hxm-mrvc-44mwMediumCVSS 5.4
OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows...
🔗 CVE IDs covered (1)
📋 Description
OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts by uploading attachments with spoofed text/html Content-Type. Attackers can upload HTML files named like test.html.pdf that render in the REMS origin via Preview, executing JavaScript in victims' browsers.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-126771
- https://gist.github.com/neelkotnis/ddf75e2cb7192180e6c9618d27d1e99b
- https://opstree.com/rems-ai-powered-observability
- https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-stored-xss-via-attachment-upload-and-preview
- https://github.com/advisories/GHSA-3hxm-mrvc-44mw