Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Custom RSE Attribute of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-25 | 1 | Disclosure1 |
| 2026-02-26 | 1 | General1 |
CVE-2026-25736 Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior… https://www.cve.org/CVERecord?id=CVE-2026-25736
Post summary
The text merely references CVE-2026-25736 in the context of Rucio, without providing additional details.
CVE-2026-25736: Science Gone Wrong: Stored XSS in Rucio WebUI Rucio, the data management heavyweight used by CERN and the scientific community to juggle petabytes of physics data, has a soft underbelly: its WebUI. A Stored Cross-Site Scripting (XSS) v... https://cvereports.com/reports/CVE-2026-25736
Post summary
A stored XSS vulnerability was disclosed in Rucio's WebUI, enabling attackers to inject malicious scripts into the interface.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | cern | rucio | - | - | - |