CVE-2026-25734: Rucio WebUI Stored XSS Vulnerability in RSE Metadata
Summary
CVE-2026-25734: Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata. Affects rucio-webui across 3 version ranges.
< 35.8.3
>= 36.0.0rc1, < 38.5.4
>= 39.0.0rc1, < 39.3.1
Fixed in 35.8.3, 38.5.4 or 39.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rucio is an open-source software framework designed for managing and transferring large amounts of data across distributed systems. It provides a WebUI that allows users to manage RSEs (Rucio Storage Elements) effectively. However, a vulnerability has been identified in the WebUI that allows for stored Cross-site Scripting (XSS) attacks, particularly in the metadata fields of RSEs.
Vulnerability Detail
A stored Cross-site Scripting (XSS) vulnerability exists in the RSE metadata of the Rucio WebUI. This vulnerability arises from the backend persisting attacker-controlled input without proper output encoding, which is later rendered in the WebUI. As a result, any user viewing affected pages may execute arbitrary JavaScript, leading to potential session token theft or unauthorized actions. The vulnerability affects metadata fields such as City, Country_Name, and ISP, which accept arbitrary input and are displayed unsafely in the RSE Management dashboard.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 35.8.335.8.3pip install --upgrade "rucio-webui==35.8.3" -
>= 36.0.0rc1, < 38.5.438.5.4pip install --upgrade "rucio-webui==38.5.4" -
>= 39.0.0rc1, < 39.3.139.3.1pip install --upgrade "rucio-webui==39.3.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using unsafe methods for rendering user-controlled data in the WebUI. Instead of using methods like .html(), utilize safer alternatives such as .text() or create text nodes. Additionally, enforce a strict Content Security Policy (CSP) and set the HttpOnly flag on session cookies to mitigate risks.
Conclusion
The stored XSS vulnerability in the Rucio WebUI poses significant risks to users by allowing the execution of arbitrary JavaScript. It is crucial to update to the patched versions of the package and implement proper security measures to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for rucio-webui →
FAQ
The vulnerability is a stored Cross-site Scripting (XSS) issue that allows attackers to inject malicious JavaScript into the RSE metadata.
Any authenticated user who views the affected RSE metadata in the Rucio WebUI is at risk of executing attacker-controlled JavaScript.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring signup.
The vulnerability can lead to session token theft, unauthorized actions, and the ability for attackers to perform actions as the victim user.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for rucio-webui.
