JavaScript Execution Vulnerability in Open OnDemand Portal by OSC
CVE-2026-44371

5.3MEDIUM

Key Information:

Vendor

Osc

Status
Ondemand
Vendor
CVE Published:
14 May 2026

What is CVE-2026-44371?

Open OnDemand, an open-source high-performance computing portal, is vulnerable to a JavaScript execution flaw that arises from specially crafted filenames. This issue affects versions prior to 4.0.11, 4.1.5, and 4.2.2. Malicious users can exploit this vulnerability to execute arbitrary JavaScript in the file browser, potentially leading to unauthorized access and data exposure. Users should update to the patched versions to mitigate this risk.

Affected Version(s)

ondemand < 4.0.11 < 4.0.11

ondemand >= 4.1.0, < 4.1.5 < 4.1.0, 4.1.5

ondemand >= 4.2.0, < 4.2.2 < 4.2.0, 4.2.2

References

https://github.com/OSC/ondemand/security/advisories/GHSA-...
x_refsource_CONFIRM

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.