Executive brief
DSpace, an open-source repository software used by libraries and research institutions, contains a security flaw in its search and discovery interface. An attacker can trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's web browser. This could lead to the theft of login sessions, unauthorized access to sensitive research data, or the display of fraudulent information to users.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in DSpace JSPUI 6.5 within the search/discover filtering component. The flaw is caused by improper sanitization and encoding of user-supplied input provided through the 'filter_type_1' parameter. A remote, unauthenticated attacker can exploit this by crafting a malicious URL containing a JavaScript payload (e.g., using an autofocus input with an onfocus event). When a victim visits the link, the payload executes in their browser context, potentially allowing for session hijacking or DOM manipulation. A proof-of-concept has been publicly disclosed.
Affected products
- Lyrasis DSpace JSPUI 6.5
Timeline
- 2026-03-27: advisory: Initial NVD publication date
- 2026-03-11: disclosed: Public PoC gist published by researcher