CVE-2026-23929

Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain.

References

https://support.zabbix.com/browse/ZBX-28068

Affected packages

Git / github.com/zabbix/zabbix

Affected ranges

Type

GIT

Repo

https://github.com/zabbix/zabbix

Events

Introduced

5203d2ea7d901cd33d148f20586e2155901a7faa

Fixed

cee258041801bce58269e37677a1b86c9fde629c

Introduced

49955f1fb5c9168a8a24b053f7ade6b3d903143c

Fixed

d607227714fc00ec6117e663d0934cb90c0f842b

Introduced

372a4e93c48ecd25aa666949a055a02369031861

Fixed

75bd32d3d61309bf44008b7de9d40d5ba4aeed8c

Database specific

Show details

{
    "cpe": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.0.46"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.25"
        },
        {
            "introduced": "7.4.0"
        },
        {
            "fixed": "7.4.9"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

6.*

6.0.0

6.0.1

6.0.10

6.0.10rc1

6.0.10rc2

6.0.11

6.0.11rc1

6.0.11rc2

6.0.12

6.0.12rc1

6.0.12rc2

6.0.13

6.0.13rc1

6.0.14

6.0.14rc1

6.0.14rc2

6.0.15

6.0.15rc1

6.0.15rc2

6.0.16

6.0.16rc1

6.0.17

6.0.17rc1

6.0.17rc2

6.0.18

6.0.18rc1

6.0.19

6.0.19rc1

6.0.1rc1

6.0.1rc2

6.0.1rc3

6.0.1rc4

6.0.2

6.0.20

6.0.20rc1

6.0.21

6.0.21rc1

6.0.22

6.0.22rc1

6.0.23

6.0.23rc1

6.0.25

6.0.25rc1

6.0.26

6.0.26rc1

6.0.27

6.0.27rc1

6.0.28

6.0.28rc1

6.0.29

6.0.29rc1

6.0.2rc1

6.0.3

6.0.30

6.0.30rc1

6.0.31

6.0.31rc1

6.0.32

6.0.32rc1

6.0.33

6.0.33rc1

6.0.34

6.0.34rc1

6.0.34rc2

6.0.35

6.0.35rc1

6.0.36

6.0.36rc1

6.0.37

6.0.37rc1

6.0.38

6.0.38rc1

6.0.39

6.0.39rc1

6.0.3rc1

6.0.4

6.0.40

6.0.40rc1

6.0.41

6.0.41rc1

6.0.42

6.0.42rc1

6.0.43

6.0.43rc1

6.0.44

6.0.44rc1

6.0.45

6.0.45rc1

6.0.46rc1

6.0.4rc1

6.0.5

6.0.5rc1

6.0.6

6.0.6rc1

6.0.7

6.0.7rc1

6.0.8

6.0.8rc1

6.0.8rc2

6.0.9

6.0.9rc1

6.0.9rc2

7.*

7.0.0

7.0.1

7.0.10

7.0.10rc1

7.0.11

7.0.11rc1

7.0.11rc2

7.0.12

7.0.12rc1

7.0.13

7.0.13rc1

7.0.14

7.0.14rc1

7.0.15

7.0.16

7.0.17

7.0.17rc1

7.0.17rc2

7.0.18

7.0.18rc1

7.0.18rc2

7.0.19

7.0.19rc1

7.0.1rc1

7.0.1rc2

7.0.2

7.0.20

7.0.20rc1

7.0.21

7.0.22

7.0.22rc1

7.0.22rc2

7.0.22rc3

7.0.23

7.0.23rc1

7.0.23rc2

7.0.24

7.0.24rc1

7.0.24rc2

7.0.24rc3

7.0.25rc1

7.0.2rc1

7.0.2rc2

7.0.3

7.0.3rc1

7.0.4

7.0.4rc1

7.0.5

7.0.5rc1

7.0.6

7.0.6rc1

7.0.7

7.0.7rc1

7.0.8

7.0.8rc1

7.0.8rc2

7.0.9

7.0.9rc1

7.0.9rc2

7.4.0

7.4.1

7.4.1rc1

7.4.2

7.4.2rc1

7.4.2rc2

7.4.3

7.4.3rc1

7.4.4

7.4.4rc1

7.4.5

7.4.6

7.4.6rc1

7.4.6rc2

7.4.7

7.4.7rc1

7.4.7rc2

7.4.7rc3

7.4.8

7.4.8rc1

7.4.8rc2

7.4.8rc3

7.4.9rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23929.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "136106974676500628095819384296506580184",
                "189079620011086932739101496157153831730",
                "17796007570490054293463654449847667250",
                "202479199046539095102022445937485727892",
                "239101855245159906132380048241102823909",
                "224016063001519858635466180994184907584"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-23929-30a9ca0d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zabbix/zabbix/commit/75bd32d3d61309bf44008b7de9d40d5ba4aeed8c",
        "target": {
            "file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "136106974676500628095819384296506580184",
                "189079620011086932739101496157153831730",
                "36490162052462539846518614666067146469",
                "62656957665135650188906633860546473017",
                "268279169556215922868823285013647302698",
                "236962407826193720376950051496116172935"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-23929-cec2296b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zabbix/zabbix/commit/d607227714fc00ec6117e663d0934cb90c0f842b",
        "target": {
            "file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "251298476628956666898959397427583219885",
                "317395765437267642752885460754421906832",
                "246560037484377983876553518236791968213",
                "132857211799543049662189930037710632272",
                "226753002036689452187127334565521006179",
                "258424649166307181966099817385825166269"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-23929-da87e516",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zabbix/zabbix/commit/cee258041801bce58269e37677a1b86c9fde629c",
        "target": {
            "file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        }
    }
]

vanir_signatures_modified

"2026-09-10T08:13:46Z"