CVE-2026-5808: XSS in openstatusHQ openstatus

Successful exploitation of CVE-2026-5808 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to a variety of malicious actions, including stealing sensitive information like authentication tokens, redirecting users to phishing sites, or modifying the application's behavior. The remote nature of the vulnerability means an attacker doesn't need local access to the system to exploit it. Given openstatus's use in operational environments, a successful attack could compromise critical infrastructure data and disrupt operations. The impact is amplified if the application is used to manage sensitive data or control critical systems.

1. Reserved2026-04-08
2. Published2026-04-08
3. Modified2026-04-09
4. EPSS updated2026-04-16

The primary mitigation for CVE-2026-5808 is to upgrade to the patched version 43d9b2b9ef8ae1a98f9bdc8a9f86d6a3dfaa2dfb. Since openstatus operates on a rolling release basis, ensure your deployment is configured to automatically receive updates. As a temporary workaround, consider implementing strict input validation on the callbackURL parameter to prevent malicious input. While a WAF might offer some protection, it's unlikely to be sufficient without proper input validation. Monitor application logs for unusual activity, particularly requests containing suspicious URLs or JavaScript code.