PT-2026-33378 · Zrok · Zrok

Published 2026-04-16 · Updated 2026-04-18 · CVE-2026-40302

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions zrok versions prior to 2.0.1

Description The proxyUi template engine utilizes Go's text/template, which does not perform HTML escaping, rather than html/template. The GitHub OAuth callback handlers in 'publicProxy' and 'dynamicProxy' embed the attacker-controlled refreshInterval query parameter directly into an error message when the time.ParseDuration() function fails. This error is then rendered unescaped into HTML. An attacker can provide a crafted login URL to a victim, and upon completion of the GitHub OAuth flow, the callback page executes arbitrary JavaScript in the OAuth server's origin.

Recommendations Update to version 2.0.1.

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

CVE-2026-40302

GHSA-4FXQ-2X3X-6XQX

Affected Products

Zrok

References · 6

• https://github.com/openziti/zrok/security/advisories/GHSA-4fxq-2x3x-6xqx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40302 · Security Note
• https://osv.dev/vulnerability/GHSA-4fxq-2x3x-6xqx · Vendor Advisory
• https://github.com/openziti/zrok · Note
• https://github.com/openziti/zrok/releases/tag/v2.0.1 · Note
• https://twitter.com/CVEnew/status/2045467392579436826 · Twitter Post