Medium 5.4

OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows...

CVE-2026-126771 First seen on SecPulse Nov 12, 03:11

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
OpsTree Solutions	OpsTree SolutionsREMS	≤ 1.0.0→ Not listed	Not listed

This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.

Original description The description as published by the source.

OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts by uploading attachments with spoofed text/html Content-Type. Attackers can upload HTML files named like test.html.pdf that render in the REMS origin via Preview, executing JavaScript in victims' browsers.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.4; CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4: Medium 5.1; CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Published: Nov 12, 2026
First seen on SecPulse: Nov 12, 03:11
GHSA: GHSA-3hxm-mrvc-44mw
CWE: CWE-79

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

JavaScript

Attack Types

Cross-Site Scripting

CWE

CWE-79

All

Opstree Solutions Rems

Detection sources

NIST National Vulnerability Database06:36
GitHub Security Advisories (Global)Nov 12, 06:33
CVE.org (CVE Program・cvelistV5)02:56