# CVE-2026-39379: GeoNetwork reflected XSS via client-side template injection in error pages

Source: https://junglewise.ai/threats/cve-2026-39379-geonetwork-reflected-xss-via-client-side-template-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-39379 · Severity: high · CVSS 7.1 · Published 2026-11-03

GeoNetwork, a platform for managing spatially referenced resources, is vulnerable to a security flaw where malicious code can be executed in a user's browser. By tricking a user into clicking a specially crafted link, an attacker can steal login credentials or perform unauthorized actions on the user's behalf. This occurs because the application's error pages incorrectly process certain parts of a web request as active code.

Technologies: [GeoNetwork-opensource GeoNetwork](https://junglewise.ai/threats/technologies/geonetwork), [org.geonetwork-opensource:geonetwork (Maven)](https://junglewise.ai/threats/technologies/org-geonetwork-opensource-geonetwork). Vendors: [GeoNetwork-opensource](https://junglewise.ai/threats/vendors/geonetwork-opensource), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-39379 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39379 being exploited in the wild.

**How severe is CVE-2026-39379?** High severity, with a CVSS score of 7.1, published 3 November 2026.

**Which products and versions are affected?** GeoNetwork-opensource GeoNetwork >= 3.0.0, <= 3.12.12; org.geonetwork-opensource:geonetwork (Maven) ECOSYSTEM:introduced=3.0.0,last_affected=3.12.12.

**Is there a fix for CVE-2026-39379?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-39379 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39379?** Check whether you run GeoNetwork-opensource GeoNetwork or org.geonetwork-opensource:geonetwork (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

GeoNetwork is vulnerable to reflected Cross-Site Scripting (XSS) due to client-side template injection (CSTI) in its error pages. When a user requests a non-existent or unauthorized service URL, the resulting AngularJS error page reflects part of the request without proper neutralization. An attacker can inject AngularJS template expressions into the URL which, when combined with sandbox-escape techniques, allows for arbitrary JavaScript execution. This attack requires user interaction (clicking a link) but no prior authentication. Patches are available in versions 4.2.15 and 4.4.10; versions 3.x and 4.0.x are unmaintained and will not receive fixes.

## Affected products

- GeoNetwork-opensource geonetwork >= 3.0.0, <= 3.12.12
- GeoNetwork-opensource geonetwork >= 4.0.0-alpha.1, <= 4.0.6
- GeoNetwork-opensource geonetwork >= 4.2.0, <= 4.2.14
- GeoNetwork-opensource geonetwork >= 4.4.0, <= 4.4.9

## Identifiers

- CVE-2026-39379
- GHSA-2v4m-fw6c-g78f

## Timeline

- 2026-07-01: advisory
- 2026-07-01: disclosed

## References

- [https://api.github.com/users/Timonheu](https://api.github.com/users/Timonheu)
- [https://github.com/Timonheu](https://github.com/Timonheu)
- [https://api.github.com/users/Timonheu/gists%7B/gist_id%7D](https://api.github.com/users/Timonheu/gists%7B/gist_id%7D)
- [https://api.github.com/users/Timonheu/repos](https://api.github.com/users/Timonheu/repos)
- [https://avatars.githubusercontent.com/u/22529761?v=4](https://avatars.githubusercontent.com/u/22529761?v=4)
- [https://api.github.com/users/Timonheu/events%7B/privacy%7D](https://api.github.com/users/Timonheu/events%7B/privacy%7D)

## Related threats

- [GeoNetwork ACL bypass in Elasticsearch search API](https://junglewise.ai/threats/cve-2026-46487-geonetwork-acl-bypass-in-elasticsearch-search-api)
- [GeoNetwork open redirect in OAuth2 and Keycloak login filters](https://junglewise.ai/threats/cve-2026-53573-geonetwork-open-redirect-in-oauth2-and-keycloak-login-filters)