HTML Injection in OPNsense Firewall and Routing Platform

CVE-2026-58391

What is CVE-2026-58391?

The OPNsense firewall and routing platform is susceptible to an HTML injection vulnerability due to improperly encoded HTML title attributes within Firewall Rules and NAT views. Prior to version 26.1.11, the lack of quote-safe encoding allows an attacker with appropriate privileges to manipulate category names and alias descriptions, potentially leading to the insertion of malicious scripts. This vulnerability enables an attacker to execute scripts in the context of an administrator or authenticated user session, which could facilitate unauthorized actions or access to sensitive information upon interaction with affected pages. OPNsense has released version 26.1.11 to address this issue and enhance security.

References