CVE-2026-23929CWE-1321

CVE-2026-23929

Medium · published August 18, 2026

CVSS v3.1

5.4

EPSS

Percentile

7.7

In the wild

Unconfirmed

What it is

Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain.

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: 8.5 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00185 · 7.7th percentile
Weakness: CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published: 2026-08-18T17:17Z

Affected products (3)

Product	Versions	Fixed in
zabbix/zabbix	≥ 6.0.0, < 6.0.46	6.0.46
zabbix/zabbix	≥ 7.0.0, < 7.0.25	7.0.25
zabbix/zabbix	≥ 7.4.0, < 7.4.9	7.4.9

References (1)

https://support.zabbix.com/browse/ZBX-28068 · [email protected]

EPSS history

Timeline

18 AUG 12:16Z
Prototype pollution leading to stored XSS
cvelistv5