# CVE-2026-48552: Nagios Core DOM-based XSS in jsonquery.js

Source: https://junglewise.ai/threats/cve-2026-48552-nagios-core-dom-based-xss-in-jsonquery-js  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-48552 · Severity: medium · CVSS 5.4 · Published 2026-08-12

Nagios Core is an open-source infrastructure monitoring system used by organizations to track and alert on IT system performance. A vulnerability in its JSON query functionality allows attackers to inject malicious JavaScript that executes in the browsers of authenticated users, potentially leading to credential theft, session hijacking, or unauthorized configuration changes to monitoring systems.

Technologies: [Nagios Enterprises Nagios Core](https://junglewise.ai/threats/technologies/nagios-core). Vendors: [Nagios Enterprises](https://junglewise.ai/threats/vendors/nagios-enterprises).

## Quick answers

**Is CVE-2026-48552 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48552 being exploited in the wild.

**How severe is CVE-2026-48552?** Medium severity, with a CVSS score of 5.4, published 12 August 2026.

**Which products and versions are affected?** Nagios Enterprises Nagios Core before 4.5.14.

**Is there a fix for CVE-2026-48552?** A patch was published on 2026-08-12: Patches available in Nagios Core 4.5.14 and Nagios XI 2026R1.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48552 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-48552?** Check whether you run Nagios Enterprises Nagios Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a DOM-based cross-site scripting (XSS) flaw in the jsonquery.js component. Unencoded JSON string values from stored fields are reflected directly into the DOM without proper sanitization, allowing an attacker to inject arbitrary JavaScript. The attack requires an authenticated user to interact with a crafted payload within the Nagios Core web interface. An attacker can execute arbitrary code in the victim's browser context, potentially stealing session tokens, modifying monitoring configurations, or harvesting sensitive data. Patches are available in Nagios Core 4.5.14 and Nagios XI 2026R1.7 or later.

## Affected products

- Nagios Enterprises Nagios Core before 4.5.14
- Nagios Enterprises Nagios XI before 2026R1.7

## Timeline

- 2026-08-12: disclosed
- 2026-08-12: patched: Patches available in Nagios Core 4.5.14 and Nagios XI 2026R1.7

## References

- [https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog](https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog)
- [https://www.nagios.com/security-disclosures/nagios-core/](https://www.nagios.com/security-disclosures/nagios-core/)

## Related threats

- [Nagios Core CSRF vulnerability in cmd.cgi](https://junglewise.ai/threats/cve-2026-48549-nagios-core-csrf-vulnerability-in-cmd-cgi)
- [Nagios Core CSRF bypass in cmd.cgi](https://junglewise.ai/threats/cve-2026-48548-nagios-core-csrf-bypass-in-cmd-cgi)
- [Nagios Core and XI authenticated remote code execution in notification macros](https://junglewise.ai/threats/cve-2026-48554-nagios-core-and-xi-authenticated-remote-code-execution-in)
- [Nagios Core authenticated remote code execution via custom-variable macro injection](https://junglewise.ai/threats/cve-2026-48553-nagios-core-authenticated-remote-code-execution-via-custom)
- [Nagios Core and XI CSRF protection bypass via double-submit cookie](https://junglewise.ai/threats/cve-2026-48551-nagios-core-and-xi-csrf-protection-bypass-via-double-submit)