PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44371 OSC CVE debrief

Open OnDemand, an open-source high-performance computing portal, had a vulnerability prior to versions 4.0.11, 4.1.5, and 4.2.2. The issue allowed specially crafted filenames to execute JavaScript in the file browser. This vulnerability is fixed in versions 4.0.11, 4.1.5, and 4.2.2. Defenders managing Open OnDemand instances, especially those with user-uploaded files or public file browsers, should assess exposure and apply patches. The vulnerability requires verification of exposure and prompt patching to prevent potential unauthorized actions or data exposure. Open OnDemand instances with user-uploaded files or public file browsers are at risk.

Vendor
OSC
Product
ondemand
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-10-26
Advisory published
2026-05-14
Advisory updated
2026-10-26

Who should care

Defenders managing Open OnDemand instances, especially those with user-uploaded files or public file browsers, should assess exposure and apply patches.

Why it matters

Defenders should care about CVE-2026-44371 because it allows JavaScript execution in the file browser of Open OnDemand instances prior to versions 4.0.11, 4.1.5, and 4.2.2. This vulnerability requires verification of exposure and prompt patching to prevent potential unauthorized actions or data exposure.

  • Potential for JavaScript execution in file browser
  • Risk of unauthorized actions or data exposure
  • Need for patch verification and application
  • Possible impact on high-performance computing portal security

Technical summary

Open OnDemand, an open-source high-performance computing portal, had a vulnerability prior to versions 4.0.11, 4.1.5, and 4.2.2. The issue allowed specially crafted filenames to execute JavaScript in the file browser. This vulnerability is fixed in versions 4.0.11, 4.1.5, and 4.2.2. The vulnerability allows JavaScript execution in the file browser of Open OnDemand instances. Defenders should prioritize verifying exposure and applying patches for Open OnDemand instances, especially those with user-uploaded files or public file browsers.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Open OnDemand instances, especially those with user-uploaded files or public file browsers.

Recommended defensive actions

  • Verify Open OnDemand instance version and exposure
  • Apply patches to upgrade to version 4.0.11, 4.1.5, or 4.2.2
  • Monitor file browser usage and JavaScript execution
  • Restrict user-uploaded file types and content

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and fixed versions. However, additional information on potential exploitation or impact is limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44371 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44371

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44371 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44371

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.