CVE-2026-40302

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40302
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40302.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40302
Aliases
Published
2026-04-17T20:56:08.368Z
Modified
2026-07-15T01:49:21.704408251Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering
Details

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template (which performs no HTML escaping) instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the attacker-controlled refreshInterval query parameter verbatim into an error message when time.ParseDuration fails, and render that error unescaped into HTML. An attacker can deliver a crafted login URL to a victim; after the victim completes the GitHub OAuth flow, the callback page executes arbitrary JavaScript in the OAuth server's origin. Version 2.0.1 patches the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-116",
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40302.json"
}
References

Affected packages

Git / github.com/openziti/zrok

Affected ranges

Type
GIT
Repo
https://github.com/openziti/zrok
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
69b9b8dd6d96be15639338414574aa5003f5f8f2
Database specific 
{
    "cpe": "cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.2.0
v0.2.0.1
v0.2.0.2
v0.2.0.3
v0.2.0.4
v0.2.1
v0.2.10
v0.2.11
v0.2.12
v0.2.13
v0.2.14
v0.2.15
v0.2.16
v0.2.17
v0.2.18
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8
v0.2.9
v0.3.0
v0.3.0-rc1
v0.3.0-rc2
v0.3.0-rc3
v0.3.0-rc4
v0.3.0-rc5
v0.3.0-rc6
v0.3.1
v0.3.2
v0.3.4
v0.3.5
v0.3.5-rc1
v0.3.6
v0.4.0
v0.4.10
v0.4.11
v0.4.12
v0.4.13
v0.4.14
v0.4.15
v0.4.16
v0.4.17
v0.4.18
v0.4.19
v0.4.2
v0.4.20
v0.4.21
v0.4.22
v0.4.23
v0.4.24
v0.4.25
v0.4.26
v0.4.27
v0.4.28
v0.4.29
v0.4.3
v0.4.30
v0.4.31
v0.4.32
v0.4.33
v0.4.34
v0.4.35
v0.4.36
v0.4.37
v0.4.38
v0.4.39
v0.4.4
v0.4.40
v0.4.41
v0.4.42
v0.4.43
v0.4.44
v0.4.45
v0.4.46
v0.4.47
v0.4.48
v0.4.49
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v2.*
v2.0.0
v2.0.0-rc5
v2.0.0-rc6
v2.0.0-rc7
v2.0.0-rc8
v2.0.0-rc9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40302.json"