CVE-2026-39379

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.

• https://github.com/geonetwork/core-geonetwork/commit/5cacdfaa6db88ef6787495b496a0871c0058b7f4
• https://github.com/geonetwork/core-geonetwork/commit/dd99c2ffb642f89b8bf72bafd04d824c9fc0d0ef
• https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.15
• https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.10
• https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2v4m-fw6c-g78f

• https://github.com/geonetwork/core-geonetwork/commit/5cacdfaa6db88ef6787495b496a0871c0058b7f4
• https://github.com/geonetwork/core-geonetwork/commit/dd99c2ffb642f89b8bf72bafd04d824c9fc0d0ef
• https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.15
• https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.10
• https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2v4m-fw6c-g78f

• CRITICALCVE-2026-44267PoC
• CRITICALCVE-2026-55486PoC
• MEDIUMCVE-2012-20003PoC
• MEDIUMCVE-2012-20004PoC
• MEDIUMCVE-2012-20005PoC
• MEDIUMCVE-2013-20009PoC
• MEDIUMCVE-2014-125131PoC
• MEDIUMCVE-2014-125132PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.