Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the RSE metadata of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-25 | 1 | Disclosure1 |
| 2026-02-26 | 1 | General1 |
CVE-2026-25734 Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior… https://www.cve.org/CVERecord?id=CVE-2026-25734
Post summary
The text references CVE-2026-25734 but provides no details on exploitation, patches, or technical specifics, merely linking to the CVE record.
CVE-2026-25734: Science vs. Scripting: Stored XSS in Rucio WebUI Rucio, the data management titan used by CERN and other scientific behemoths, suffered from a classic web vulnerability: Stored Cross-Site Scripting (XSS). Buried within the Rucio Storag... https://cvereports.com/reports/CVE-2026-25734
Post summary
The post announces a stored XSS vulnerability in Rucio WebUI, but provides no evidence of exploitation, PoC, or patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | cern | rucio | - | - | - |