CVE-2026-23929 Prototype pollution leading to stored XSS
Attackers can inject malicious scripts via URL parameters in Zabbix Maps, leading to stored XSS and potential account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-23929?
CVE-2026-23929 is a high-severity cross-site scripting vulnerability in Zabbix Zabbix, published on 18 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain.
Weakness: CWE-1321
Which versions are affected by CVE-2026-23929?
It affects 1 product.
Products include Zabbix Zabbix.
How do I fix CVE-2026-23929?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-23929 being exploited?
There is no known exploitation of CVE-2026-23929 in the wild and no public exploit code.
Other vulnerabilities in Zabbix Zabbix
Sources
Also known as DEBIAN-CVE-2026-23929, GHSA-x27p-fpr7-4wpm, UBUNTU-CVE-2026-23929.