CVE-2026-39379: 
Java vulnerability analysis and mitigation

CVE-2026-39379 is a reflected Cross-Site Scripting (XSS) vulnerability in GeoNetwork caused by client-side template injection in AngularJS-rendered error pages. An unauthenticated attacker can craft a malicious URL that, when visited by a victim, causes arbitrary JavaScript to execute in the victim's browser session. The vulnerability affects GeoNetwork versions 3.0.0–3.12.12, 4.0.0-alpha.1–4.0.6, 4.2.0–4.2.14, and 4.4.0–4.4.9. It was published on July 1, 2026, with patched versions 4.2.15 and 4.4.10 released simultaneously. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, GeoNetwork Advisory).

The root cause is insufficient output neutralization (CWE-79) combined with improper handling of template engine special elements (CWE-1336). When a user requests a non-existent or unauthorized service URL, GeoNetwork's error page reflects part of the original request back to the user without sanitizing it for the AngularJS rendering context. Because the error page is an AngularJS application, attacker-controlled content embedded in the reflected value is interpreted as an AngularJS template expression (e.g., {{...}}) and evaluated client-side upon page load. By combining this reflection with known AngularJS sandbox-escape techniques, an attacker can escalate from template expression evaluation to full arbitrary JavaScript execution (GitHub Advisory, GeoNetwork Advisory).

Successful exploitation allows arbitrary JavaScript to execute in the context of the victim's authenticated GeoNetwork session, enabling credential harvesting (e.g., via injected fake login forms), session token theft, and unauthorized actions performed on the victim's behalf. Confidentiality impact is rated low (limited data exposure), while integrity impact is rated high due to the ability to manipulate application behavior and data on behalf of the victim. Availability is not impacted. Administrators are particularly high-value targets, as compromising their sessions could lead to full application takeover (GitHub Advisory).

No privileges are required to craft the malicious URL, and exploitation only requires that a victim (including an administrator) clicks the link, making social engineering the primary delivery mechanism. No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory date. The CVE status is listed as "Reserved" and the vulnerability was disclosed on July 1, 2026. No EPSS score or CISA KEV catalog entry is currently available for this CVE (GitHub Advisory).

1. Reconnaissance: Identify publicly accessible GeoNetwork instances running affected versions (3.0.0–3.12.12, 4.0.0-alpha.1–4.0.6, 4.2.0–4.2.14, or 4.4.0–4.4.9) using search engines, Shodan, or Censys.
2. Identify reflective endpoint: Determine a GeoNetwork service URL path that triggers the error page (e.g., a non-existent or unauthorized service endpoint) and confirm that request parameters are reflected in the AngularJS error page response.
3. Craft malicious URL: Construct a URL that injects an AngularJS template expression into the reflected parameter, such as appending a payload like {{constructor.constructor('malicious_code')()}} combined with a known AngularJS sandbox-escape technique to the service URL.
4. Deliver the link: Send the crafted URL to a target user (preferably an administrator) via phishing email, social media, or other social engineering channels.
5. Achieve JavaScript execution: When the victim visits the link, the GeoNetwork error page loads and the AngularJS engine evaluates the injected template expression, executing the attacker's JavaScript in the victim's browser session.
6. Exploit the session: Use the executed script to exfiltrate session tokens, inject a fake login form to harvest credentials, or perform unauthorized API actions on behalf of the victim (GitHub Advisory, GeoNetwork Advisory).

• Network: HTTP GET requests to GeoNetwork service URLs containing AngularJS template expression syntax (e.g., %7B%7B, {{, }}) in URL parameters or path segments; unusual outbound requests from the victim's browser to attacker-controlled domains following GeoNetwork error page loads.
• Logs: GeoNetwork access logs showing requests to non-existent or unauthorized service endpoints with URL-encoded template expression payloads (e.g., %7B%7Bconstructor, %7B%7B$eval); repeated 404 or 403 responses to URLs with suspicious parameter values.
• Browser/Client: Unexpected form submissions or XHR requests originating from GeoNetwork error pages; browser developer tools showing evaluation of injected script content within the GeoNetwork error page DOM.

GeoNetwork has released patched versions 4.2.15 and 4.4.10 that address this vulnerability by properly neutralizing reflected content before it is rendered in the AngularJS error page context. GeoNetwork 3.x and 4.0.x are archived and unmaintained; instances running those versions will not receive a fix and should be upgraded to a supported release (4.2.15 or later, or 4.4.10 or later) immediately. No configuration-based workaround is documented; upgrading is the only recommended remediation (GitHub Advisory, GeoNetwork Advisory).

The vulnerability was reported by security researcher Timonheu, with remediation development credited to jodygarnett and coordination by juanluisrp within the GeoNetwork project. The advisory was published and reviewed on July 1, 2026, with no significant broader media coverage or notable community commentary identified beyond the official GitHub advisory (GitHub Advisory).