CVE-2026-25733: Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS)
Summary
CVE-2026-25733: Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function. Affects rucio-webui across 3 version ranges.
< 35.8.3
>= 36.0.0rc1, < 38.5.4
>= 39.0.0rc1, < 39.3.1
Fixed in 35.8.3, 38.5.4 or 39.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rucio is an open-source software framework designed for managing and transferring large datasets across distributed storage systems. It provides a WebUI that allows users to interact with the system, manage subscriptions, and create rules for data handling. However, a vulnerability has been identified in the WebUI's Custom Rules function, which allows for the storage of attacker-controlled input that can lead to Cross-site Scripting (XSS) attacks.
Vulnerability Detail
A stored Cross-site Scripting (XSS) vulnerability exists in the Custom Rules function of the Rucio WebUI. The vulnerability arises when user input, specifically in the 'comment' field, is not properly sanitized before being stored and later rendered in the WebUI. This allows an attacker to inject arbitrary JavaScript code that executes in the context of the WebUI for any user who views the affected pages. The potential ramifications include session token theft, unauthorized actions, and the ability to manipulate user accounts or data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 35.8.335.8.3pip install --upgrade "rucio-webui==35.8.3" -
>= 36.0.0rc1, < 38.5.438.5.4pip install --upgrade "rucio-webui==38.5.4" -
>= 39.0.0rc1, < 39.3.139.3.1pip install --upgrade "rucio-webui==39.3.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that any user-controlled data is properly escaped before being rendered in the WebUI. Avoid using unsafe methods such as .html() for inserting content into the DOM.
Conclusion
The Rucio WebUI has a critical stored XSS vulnerability that can lead to severe security issues for users. It is essential to update to the patched versions of the package and implement proper data sanitization practices to mitigate risks.
See every vulnerability recorded for rucio-webui →
FAQ
The vulnerability is a stored Cross-site Scripting (XSS) issue that allows an attacker to inject malicious JavaScript code into the Rucio WebUI.
Any authenticated user of the Rucio WebUI who views affected resources is at risk of executing attacker-controlled JavaScript.
The impacts include session token theft, unauthorized actions, and the ability to manipulate user accounts or data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.3, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for rucio-webui.
