CVE-2026-58205 GRR has a Reflected XSS issue

High 8.1 Published 27 Oct 2026 Updated 29 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-58205?

CVE-2026-58205 is a high-severity vulnerability in JeromeDevome GRR, published on 27 Oct 2026.

Official description

GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0.

Weakness: CWE-79

Which versions are affected by CVE-2026-58205?

How do I fix CVE-2026-58205?

No fix has been published for CVE-2026-58205 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-58205 being exploited?

There is no known exploitation of CVE-2026-58205 in the wild and no public exploit code.

Sources

Also known as GHSA-r6x2-w38j-vvq2.