CVE-2026-39379: GeoNetwork has reflected XSS through client-side template injection

July 1, 2026 (updated July 2, 2026)

It is possible to craft a URL that causes GeoNetwork to reflect attacker-controlled content into an error page in a way that gets evaluated as a client-side template expression. Combined with known AngularJS sandbox-escape techniques, this can be used to execute arbitrary JavaScript in the victim’s browser (reflected Cross-Site Scripting via client-side template injection).

References

github.com/advisories/GHSA-2v4m-fw6c-g78f
github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2v4m-fw6c-g78f
nvd.nist.gov/vuln/detail/CVE-2026-39379

Code Behaviors & Features

Detect and mitigate CVE-2026-39379 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →