CVE-2026-38961 in pfSense
Summary
by MITRE • 09/04/2026
Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any authenticated user who views the dashboard, due to insufficient sanitization of feed title data before rendering in the widget.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The identified vulnerability represents a classic Stored Cross-Site Scripting flaw within the RSS Widget component of Netgate pfSense Plus versions 26.03 and 25.11.1, as well as pfSense CE version 2.8.1. This security defect arises from insufficient input validation and output encoding mechanisms when processing data retrieved from external RSS feeds. Specifically, the application fails to adequately sanitize or encode special characters within the title field of an RSS feed item before rendering it in the user interface. Consequently, if a malicious actor controls or influences the content of an RSS feed consumed by the pfSense dashboard, they can inject arbitrary JavaScript code into the page context. This vulnerability is particularly concerning because it affects authenticated users who access the system's web GUI to monitor network status and configurations.
From a technical perspective, the root cause lies in the lack of proper Context-Aware Output Encoding when displaying dynamic content from RSS feeds within HTML elements without appropriate escaping. When an authenticated user navigates to the dashboard where the RSS Widget is active, the browser parses the injected script as executable code rather than static text. This execution occurs within the security context of the pfSense web interface, granting the attacker the same privileges and access rights as the viewing user. The attack vector relies on social engineering or compromise of a trusted news source to distribute malicious feed titles that trigger this behavior upon display in the victim's browser session.
The operational impact of this vulnerability is significant for organizations relying on pfSense for network perimeter defense. An attacker can exploit this flaw to perform various actions, including stealing session cookies and authentication tokens, thereby facilitating account takeover attacks. Additionally, the injected script could be used to deface the dashboard interface, redirect users to phishing sites designed to harvest credentials, or execute further malicious payloads against other internal systems if combined with additional vulnerabilities such as Cross-Site Request Forgery weaknesses. Since the execution happens on every authenticated user who views the widget, a single compromised feed can lead to widespread compromise across all administrators and operators accessing the system during that period.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1059.007, specifically JavaScript execution within a browser environment. It also relates to the initial access and persistence phases where attackers leverage trusted applications or feeds to maintain footholds within an organization's network infrastructure without triggering immediate alarms due to its origin from seemingly legitimate data sources.
Mitigation strategies should focus on both technical remediation and operational best practices. The primary solution is for Netgate to release a patched version of pfSense that implements strict input validation and output encoding for all RSS feed fields, particularly titles, ensuring that any script-like content is neutralized before rendering in the DOM. Administrators currently running affected versions should immediately restrict access to the web GUI using strong authentication methods such as multi-factor authentication to reduce the risk of credential theft via XSS. Furthermore, organizations should consider disabling the RSS Widget if it is not strictly necessary for their operational workflow, thereby eliminating the attack surface entirely until a patch is available. Regular monitoring of feed sources and implementing content security policies can also help mitigate potential impacts by restricting script execution contexts within the browser environment.