CVE-2026-40302: 
NixOS vulnerability analysis and mitigation

CVE-2026-40302 is a reflected Cross-Site Scripting (XSS) vulnerability in zrok, an open-source tool for sharing web services, files, and network resources. The flaw exists in the GitHub OAuth callback handlers, where an attacker-controlled refreshInterval query parameter is embedded unescaped into an HTML error page. All versions prior to 2.0.1 (including 1.1.0 and earlier) are affected. The vulnerability was published on April 17, 2026, with a patch released in version 2.0.1. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The root cause is the use of Go's text/template package (which performs no HTML escaping) instead of html/template in the proxyUi template engine (CWE-79, CWE-116). The GitHub OAuth callback handlers in both publicProxy (endpoints/publicProxy/providerGithub.go) and dynamicProxy (endpoints/dynamicProxy/providerGithub.go) pass the refreshInterval query parameter to time.ParseDuration; when parsing fails, the raw attacker-controlled value is embedded verbatim into an error message rendered via {{ .Error }} in endpoints/proxyUi/template.html without HTML escaping. An attacker crafts a login URL with a malicious refreshInterval value containing JavaScript; after the victim completes the GitHub OAuth flow, the callback page renders the injected script in the OAuth server's origin (GitHub Advisory).

Successful exploitation allows arbitrary JavaScript execution in the OAuth server's origin after a victim completes the GitHub OAuth flow. Because the script runs in the OAuth server's origin, an attacker can access DOM content visible at that point, initiate new OAuth flows, or submit forms on behalf of the victim — potentially stealing OAuth credentials or performing unauthorized actions. Confidentiality and integrity impacts are rated Low; there is no availability impact. The scope is marked as Changed, as the injected script executes in the OAuth server's origin rather than the victim's share origin (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is 0.01% (0.000100), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — the victim must click a crafted link and complete the GitHub OAuth flow — but requires no privileges or special conditions on the attacker's side.

1. Craft malicious URL: Construct a login URL targeting the zrok instance's GitHub OAuth callback endpoint, injecting a JavaScript payload into the refreshInterval query parameter (e.g., refreshInterval=<script>alert(document.cookie)</script> or a URL-encoded equivalent that causes time.ParseDuration to fail).
2. Deliver to victim: Send the crafted URL to a target user via phishing email, social engineering, or any other delivery mechanism that causes the victim to click the link.
3. Victim completes OAuth flow: The victim clicks the link and is redirected through the GitHub OAuth authentication flow, completing login as normal.
4. Trigger XSS: Upon OAuth callback, the server attempts to parse the malicious refreshInterval value with time.ParseDuration, which fails; the raw value is embedded into the error message and rendered unescaped via text/template into the HTML response.
5. Execute arbitrary JavaScript: The victim's browser executes the injected script in the OAuth server's origin, allowing the attacker to access DOM content, initiate new OAuth flows, exfiltrate visible data, or perform actions on behalf of the victim (GitHub Advisory).

• Network: HTTP requests to the GitHub OAuth callback endpoint (e.g., /oauth/github/callback or equivalent) containing unusual or non-numeric values in the refreshInterval query parameter, particularly values with HTML/JavaScript characters (<, >, script, javascript:, etc.).
• Logs: Web server or application logs showing OAuth callback requests with malformed refreshInterval values that fail time.ParseDuration parsing; error log entries from providerGithub.go callback handlers referencing invalid duration strings.
• Network: Unexpected outbound requests from victim browsers to attacker-controlled domains following OAuth callback page loads, which may indicate successful XSS payload execution.

The primary remediation is to upgrade zrok to version 2.0.1 or later, which fixes the issue by switching the proxyUi template engine from text/template to html/template and removing reflected refreshInterval values from GitHub OAuth error pages (zrok v2.0.1 Release). No official workaround is provided by the vendor for users unable to upgrade immediately. As interim mitigations, administrators can restrict access to OAuth callback endpoints, implement strict Content Security Policy (CSP) headers to limit JavaScript execution, and monitor for OAuth callback requests containing unusual refreshInterval parameter values (GitHub Advisory).

The vulnerability was credited to researcher bugbunny-research and disclosed via GitHub Security Advisories by maintainer mikegorman-nf on April 16, 2026 (GitHub Advisory). Community discussion was noted on Bluesky and various CVE tracking platforms shortly after disclosure. No significant broader media coverage or notable security researcher commentary beyond the advisory itself has been identified.