CVE-2026-85453

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85453
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85453.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-85453
Published
2026-09-03T22:38:40Z
Modified
2026-09-10T03:30:23Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scripting
Details

MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing attackers to inject malicious scripts. Any MOOS publisher can set variable values containing script payloads that execute in the browser of operators viewing the web interface.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85453.json"
}
References

Affected packages

Git / github.com/themoos/core-moos

Affected ranges

Type
GIT
Repo
https://github.com/themoos/core-moos
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
19d06a9aefc910b0504c2c8589b1403f3b6e77a8
Fixed
a3f26f099bb08decb143f704d8b1ca16ae405b44
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "10.4.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

10.*
10.0.1-devel
10.0.2-devel
10.0.3-devel-candidate
Other
IvPCompatibility
PreProfilingmerge
v10.*
v10.0.4-alpha

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85453.json"