Executive brief
GeoNetwork, a platform for managing spatially referenced resources, is vulnerable to a security flaw where malicious code can be executed in a user's browser. By tricking a user into clicking a specially crafted link, an attacker can steal login credentials or perform unauthorized actions on the user's behalf. This occurs because the application's error pages incorrectly process certain parts of a web request as active code.
Technical details
GeoNetwork is vulnerable to reflected Cross-Site Scripting (XSS) due to client-side template injection (CSTI) in its error pages. When a user requests a non-existent or unauthorized service URL, the resulting AngularJS error page reflects part of the request without proper neutralization. An attacker can inject AngularJS template expressions into the URL which, when combined with sandbox-escape techniques, allows for arbitrary JavaScript execution. This attack requires user interaction (clicking a link) but no prior authentication. Patches are available in versions 4.2.15 and 4.4.10; versions 3.x and 4.0.x are unmaintained and will not receive fixes.
Affected products
- GeoNetwork-opensource geonetwork >= 3.0.0, <= 3.12.12
- GeoNetwork-opensource geonetwork >= 4.0.0-alpha.1, <= 4.0.6
- GeoNetwork-opensource geonetwork >= 4.2.0, <= 4.2.14
- GeoNetwork-opensource geonetwork >= 4.4.0, <= 4.4.9
Timeline
- 2026-07-01: advisory
- 2026-07-01: disclosed