Executive brief
OSCAL-GUI, a tool used by government agencies to manage security compliance documentation, is vulnerable to a security flaw that allows attackers to run malicious code in a user's browser. By tricking a user into clicking a specially crafted link, an attacker could steal login sessions, redirect users to fraudulent sites, or capture sensitive information entered into the application. This issue affects the core interface used for viewing and editing security project forms.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in OSCAL-GUI due to improper sanitization of the 'project' GET parameter. In 'oscal-functions.php', the application URL-decodes the 'project' parameter and assigns it to '$project_id' without filtering. If a project ID is not found, this unsanitized value is concatenated into an error message via the 'Messages()' function and reflected directly into the HTML response. A second vector exists in 'oscal-begin.php' where the parameter is concatenated into a JavaScript string assigned to '$script' and subsequently rendered in the 'onload' attribute of the HTML body in 'oscal.php'. Attackers can exploit this by crafting malicious URLs that, when visited by a victim, execute arbitrary JavaScript in the context of the victim's session. The affected project was archived in March 2026, and no official patch has been released.
Affected products
- NIST / FedRAMP (Brian Ruf) OSCAL-GUI <= c989c4b
Timeline
- 2026-03-27: other: Project archived by maintainer
- 2026-06-05: disclosed: Researcher proof-of-concept published
- 2026-06-09: advisory: CVE published and VulnCheck advisory released