CVE-2026-44371CWE-79

Open OnDemand: Specially crafted filenames can execute javascript in the file browser

Medium · published May 14, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
37.5
In the wild
Unconfirmed
What it is

Open OnDemand is an open-source high-performance computing portal. Prior to 4.0.11, 4.1.5, and 4.2.2, specially crafted filenames can execute javascript in the file browser This vulnerability is fixed in 4.0.11, 4.1.5, and 4.2.2.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00444 · 37.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-14T15:02Z
EPSS history
Timeline
  • 14 MAY 15:02Z
    Open OnDemand: Specially crafted filenames can execute javascript in the file browser
    cvelistv5