Executive brief
Open OnDemand, a web portal for high-performance computing, is vulnerable to a security flaw where malicious filenames can trigger unauthorized code execution. If a user views a directory containing a file with a specially crafted name, an attacker could execute JavaScript in the user's browser session. This could lead to unauthorized actions being performed on behalf of the user or the theft of session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Open OnDemand file browser component. The application fails to properly neutralize or escape filenames before rendering them in the web interface. An attacker can exploit this by creating a file with a name containing a malicious JavaScript payload; when a victim navigates to the directory containing that file, the script executes in the context of their browser session. This vulnerability is tracked as CWE-79 and is resolved in versions 4.0.11, 4.1.5, and 4.2.2.
Affected products
- OSC Open OnDemand < 4.0.11, < 4.1.5, < 4.2.2
Timeline
- 2026-04-30: advisory: GitHub advisory published by vendor
- 2026-05-14: disclosed: CVE published to NVD