CVE-2026-58205— GRR has a Reflected XSS issue

Quick assessment

Affected

JeromeDevome GRR

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GRR 是一款资源管理与预订应用。在 4.5.0 版本之前，若安装文件仍可访问，会在未进行充分转义的情况下反射参数。这些文件的删除并非自动完成。攻击者可构造恶意 URL，当受害者访问该链接时，在其浏览器中执行任意 JavaScript 代码。这种反射型跨站脚本（XSS）漏洞可导致钓鱼攻击、重定向至恶意网站、窃取 Cookie 以及会话劫持，因为认证 Cookie 未设置属性。该问题已在 4.5.0 版本中修复。

CVSS 8.1 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1055.001 · Dynamic-link Library Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GRR has a Reflected XSS issue

Source: CVE Program / CVE List V5

Vulnerability Description

GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
JeromeDevome	GRR	< 4.5.0	-

II. Public POCs for CVE-2026-58205

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-58205

请登录查看更多情报信息。

Other References for CVE-2026-58205 (3)

https://github.com/JeromeDevome/GRR/tree/v4.5.0 x_refsource_MISC
https://github.com/JeromeDevome/GRR/security/advisories/GHSA-r6x2-w38j-vvq2 x_refsource_CONFIRM
https://github.com/JeromeDevome/GRR/commit/4ef77f91818215c1f8e0f06023d89257dfd61c68 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-58205

Same Patch Batch · JeromeDevome · 2026-10-27 · 3 CVEs total

CVE-2026-58256	9.1 CRITICAL	GRR vulnerable to Remote Code Execution Via PHP Code Injection
CVE-2026-58257	7.2 HIGH	GRR vulnerable to Arbitrary File Read and Deletion

IV. Related Vulnerabilities

Same product: GRR

Same vendor: JeromeDevome

Same weakness: CWE-79