Executive brief
pfSense is a widely-deployed open-source firewall that protects networks via a web-based management interface. The RSS widget on the firewall's dashboard can display news feeds, but insufficient sanitization of feed post titles allows a malicious RSS feed to inject JavaScript code that executes in the browser of any authenticated user viewing the dashboard. An attacker controlling an RSS feed could steal session cookies or perform actions on behalf of administrators.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the rss.widget.php component of pfSense Plus and pfSense Community Edition. The RSS widget failed to sanitize or encode feed post titles before rendering them in HTML, allowing arbitrary JavaScript injection via specially crafted RSS feed content. Attack requires: (1) an authenticated user with the RSS widget active on their dashboard, (2) the widget configured to pull from an attacker-controlled or compromised RSS feed. The injected script executes in the victim's browser with their session privileges. The fix, committed on 2026-03-31, adds HTML encoding and tag stripping via htmlspecialchars(strip_tags()) to the title rendering logic.
Affected products
- Netgate pfSense Plus 26.03 and earlier
- Netgate pfSense Community Edition 2.8.1 and earlier
Timeline
- 2026-04-01: disclosed: Initial security advisory published
- 2026-03-31: patched: Fix committed to pfSense Plus master (26.07) and pfSense CE master (2.9.0)
- 2026-09-03: other: CVE-2026-38961 assigned