Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2026-25735: Rucio WebUI can run malicious code in browsers
CVE-2026-25735 · published 8 months ago
Summary
The web interface of Rucio (versions before 35.8.3, 38.5.4, and 39.3.1) can store user-supplied text that is later shown without cleaning it, letting an attacker place hidden JavaScript. When a user opens the affected page, the code runs in their browser, which could steal login cookies or perform actions as that user. Update the Rucio WebUI to the listed patched versions to stop this risk.
What to do
- Update rucio rucio-webui to version 35.8.3.
- Update rucio rucio-webui to version 38.5.4.
- Update rucio rucio-webui to version 39.3.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | rucio | rucio-webui |
< 35.8.3 >= 36.0.0rc1, < 38.5.4 >= 39.0.0rc1, < 39.3.1 Fix: upgrade to 35.8.3
|
| – | cern | rucio |
< 35.8.3 >= 36.0.0, < 38.5.4 >= 39.0.0, < 39.3.1 cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:* |
Original advisory text
Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Identity Name of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
References
- https://github.com/advisories/GHSA-8wpv-6x3f-3rm5
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_C... URL
- https://github.com/rucio/rucio/releases/tag/35.8.3 URL
- https://github.com/rucio/rucio/releases/tag/38.5.4 URL
- https://github.com/rucio/rucio/releases/tag/39.3.1 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25735... Vendor Advisory
- https://github.com/rucio/rucio/security/advisories/GHSA-8wpv-6x3f-3rm5 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25735 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
CWE-1004Sensitive Cookie Without 'HttpOnly' Flag
Timeline
Published25 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta