CVE-2026-48552

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48552
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48552.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48552
Downstream
Published
2026-08-12T16:34:33Z
Modified
2026-09-10T03:30:24Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Nagios Core / XI DOM-based XSS via jsonquery.js
Details

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browser.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48552.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "2026R1.7"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/nagiosenterprises/nagioscore

Affected ranges

Type
GIT
Repo
https://github.com/nagiosenterprises/nagioscore
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cfa5684eb50facc3183d5ddb01d853b9eb9cc218
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.5.14"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

4.*
4.2.1
nagios-1.*
nagios-1.0a6
nagios-1.0a7
nagios-1.0b1
nagios-1.0b2
nagios-1.0b3
nagios-1.0b4
nagios-1.0b5
nagios-1.0b6
nagios-2.*
nagios-2.0
nagios-2.0.b5
nagios-2.0b1
nagios-2.0b2
nagios-2.0b3
nagios-2.0b4
nagios-2.0b6
nagios-2.0rc1
nagios-3.*
nagios-3.0
nagios-3.0.1
nagios-3.0.2
nagios-3.0.3
nagios-3.0.4
nagios-3.0.5
nagios-3.0.6
nagios-3.0a1
nagios-3.0a2
nagios-3.0a3
nagios-3.0a4
nagios-3.0a5
nagios-3.0b1
nagios-3.0b2
nagios-3.0b3
nagios-3.0b4
nagios-3.0b5
nagios-3.0b6
nagios-3.0b7
nagios-3.0rc1
nagios-3.0rc2
nagios-3.0rc3
nagios-3.1.0
nagios-3.1.1
nagios-3.1.2
nagios-3.2.0
nagios-3.2.1
nagios-3.2.2
nagios-3.2.3
nagios-3.3.1
nagios-3.4.0
nagios-3.4.1
nagios-4.*
nagios-4.0.0
nagios-4.0.0-beta1
nagios-4.0.0-beta2
nagios-4.0.0-beta3
nagios-4.0.0-beta4
nagios-4.0.4
nagios-4.0.5
nagios-4.0.6
nagios-4.1.0
nagios-4.1.0rc2
nagios-4.1.1
nagios-4.2.2
nagios-4.3.0
nagios-4.3.1
nagios-4.3.2
nagios-4.3.3
nagios-4.3.4
nagios-4.4.0
nagios-4.4.1
nagios-4.4.10
nagios-4.4.11
nagios-4.4.12
nagios-4.4.13
nagios-4.4.14
nagios-4.4.3
nagios-4.4.3rc1
nagios-4.4.4
nagios-4.4.5
nagios-4.4.6
nagios-4.4.7
nagios-4.4.8
nagios-4.4.9
nagios-4.5.0
nagios-4.5.1
nagios-4.5.10
nagios-4.5.11
nagios-4.5.12
nagios-4.5.13
nagios-4.5.2
nagios-4.5.3
nagios-4.5.4
nagios-4.5.5
nagios-4.5.6
nagios-4.5.7
nagios-4.5.8
nagios-4.5.9
release-4.*
release-4.2.4
release-4.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48552.json"