Executive brief
Nagios Core is an open-source infrastructure monitoring system used by organizations to track and alert on IT system performance. A vulnerability in its JSON query functionality allows attackers to inject malicious JavaScript that executes in the browsers of authenticated users, potentially leading to credential theft, session hijacking, or unauthorized configuration changes to monitoring systems.
Technical details
The vulnerability is a DOM-based cross-site scripting (XSS) flaw in the jsonquery.js component. Unencoded JSON string values from stored fields are reflected directly into the DOM without proper sanitization, allowing an attacker to inject arbitrary JavaScript. The attack requires an authenticated user to interact with a crafted payload within the Nagios Core web interface. An attacker can execute arbitrary code in the victim's browser context, potentially stealing session tokens, modifying monitoring configurations, or harvesting sensitive data. Patches are available in Nagios Core 4.5.14 and Nagios XI 2026R1.7 or later.
Affected products
- Nagios Enterprises Nagios Core before 4.5.14
- Nagios Enterprises Nagios XI before 2026R1.7
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Patches available in Nagios Core 4.5.14 and Nagios XI 2026R1.7