Quick answers
- Is CVE-2026-49131 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-49131 being exploited in the wild.
- How severe is CVE-2026-49131?
- Medium severity, with a CVSS score of 5.4, published 3 August 2026.
- Which products and versions are affected?
- OPNsense before 26.1.9.
- Is there a fix for CVE-2026-49131?
- A patch was published on 26.1.9: Fix applied via commit b11d6b3 adding html_safe() escaping to firewall rule description output Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-49131 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-49131?
- Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the firewall rule description field, where unsanitized user input is persisted to the database via the filter API endpoint. The vulnerable component is the default cell formatter in opnsense_bootgrid.js, which renders rule descriptions by directly assigning raw cell content to innerHTML without sanitization. An authenticated attacker with firewall rule management privileges can embed arbitrary HTML or JavaScript payloads in the description field. When any authenticated user accesses the Firewall Rules page, the injected scripts execute in their browser context with the same privileges. The vulnerability was fixed in version 26.1.9 by adding an HTML escape function to sanitize the description output before rendering.
Affected products
- OPNsense OPNsense before 26.1.9
Timeline
- 2026-08-03: disclosed
- 26.1.9: patched: Fix applied via commit b11d6b3 adding html_safe() escaping to firewall rule description output