CVE-2026-85453 in core-moos
Summary
by MITRE • 09/04/2026
MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing attackers to inject malicious scripts. Any MOOS publisher can set variable values containing script payloads that execute in the browser of operators viewing the web interface.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified within MOOS core versions up to 10.4.0 represents a critical Cross-Site Scripting (XSS) flaw rooted in insufficient input validation and output encoding during the rendering of HTTP-based database pages. This security defect allows for the injection of malicious scripts into web interfaces that are intended to display data from the Mission Oriented Operating Suite (MOOS) database, commonly referred to as MOOSDB. The core issue lies in the failure of the application to properly escape or sanitize user-supplied content before it is rendered by the client-side browser. This lack of proper encoding means that any special characters or script tags embedded within data values are interpreted as executable code rather than static text, fundamentally breaking the trust boundary between the server and the client.
The operational impact of this vulnerability is significant due to the specific access model inherent in MOOS systems. In a typical MOOS deployment, various nodes act as publishers that contribute data variables to the central database. The flaw permits any node with publishing privileges to inject malicious payloads directly into these variable values. When an operator or administrator accesses the web interface to monitor system status or control autonomous vehicles and robots, their browser executes the injected scripts in the context of the authenticated session. This scenario effectively transforms a standard data publication action into a vector for client-side code execution, bypassing traditional server-side security controls that might otherwise mitigate such threats if they were applied at the rendering stage rather than just at ingestion or storage.
From an industry standards perspective, this vulnerability aligns with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation as a classic Cross-Site Scripting weakness. The attack vector leverages the trusted nature of the web application to execute scripts in the victim's browser, facilitating actions such as session hijacking, credential theft via keyloggers, or defacement of the operational interface. Furthermore, this behavior maps directly to MITRE ATT&CK technique T1059.007, which covers JavaScript execution under command and script interpretation. The ability for any publisher to influence the view of an operator creates a persistent threat landscape where compromised nodes can silently exfiltrate sensitive information or manipulate operational decisions by altering displayed data through DOM manipulation scripts embedded in the payload.
Mitigation strategies must focus on implementing robust output encoding mechanisms specifically tailored for HTML contexts within the MOOS web interface components. Developers should ensure that all dynamic content derived from database variables is strictly escaped before being inserted into the Document Object Model, utilizing established libraries or framework features designed to prevent XSS attacks. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of successful injections by restricting the sources from which scripts are allowed to load and execute. For immediate risk reduction, access controls should be reviewed to ensure that only trusted, authenticated nodes have publishing privileges, thereby limiting the attack surface available to potential adversaries seeking to exploit this flaw for unauthorized code execution within the operational environment.