CVE-2026-48552 in Nagios Core
Summary
by MITRE • 08/12/2026
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browser.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability affects Nagios Core versions prior to 4.5.14 and Nagios XI versions prior to 2026R1.7, representing a critical dom-based cross-site scripting flaw that leverages improper input sanitization in the jsonquery.js component. The technical implementation involves the direct insertion of unencoded JSON string values into the document object model without proper sanitization or encoding mechanisms, creating an environment where malicious payloads can be executed within victim browsers. The vulnerability stems from how stored field data is processed and reflected back to the client-side interface, where JSON responses containing user-supplied content are directly embedded into DOM elements without appropriate security measures.
The operational impact of this vulnerability extends beyond simple script execution as it enables attackers to manipulate the Nagios monitoring interface in ways that can compromise system integrity and confidentiality. An attacker could potentially inject malicious JavaScript code through specially crafted input in stored fields such as host names, service descriptions, or other configurable parameters that are later processed by jsonquery.js. This allows for session hijacking, credential theft, data manipulation within the monitoring environment, and potential lateral movement within networks where Nagios systems are deployed. The dom-based nature of this vulnerability means that the attack vector originates from client-side behavior rather than server-side injection points, making it particularly challenging to detect and prevent through traditional network-based security measures.
The vulnerability maps directly to CWE-79 - Improper Neutralization of Input During Web Page Generation into a Browser, which specifically addresses situations where user-controllable data enters a web page without proper sanitization or encoding. This classification aligns with the ATT&CK technique T1566.001 - Phishing: Spearphishing Attachment, as attackers could craft malicious input that appears legitimate within the Nagios interface but executes harmful code when processed by jsonquery.js. The flaw also relates to T1059.007 - Command and Scripting Interpreter: JavaScript, since successful exploitation allows arbitrary javascript execution within the victim's browser context.
Mitigation strategies should focus on implementing proper input sanitization and output encoding mechanisms throughout the jsonquery.js processing pipeline. Organizations must ensure that all JSON string values are properly encoded before being inserted into DOM elements, utilizing established encoding functions such as JSON.stringify with appropriate escaping or HTML entity encoding. The most effective remediation involves upgrading to Nagios Core 4.5.14 or later versions and Nagios XI 2026R1.7 or newer releases where the vulnerability has been addressed through proper input validation and sanitization measures. Additionally, implementing content security policies and regular security audits of web application components can help detect and prevent similar vulnerabilities in other parts of the monitoring infrastructure.