jmpsec github.com/jmpsec/osctrl vulnerabilities

Latest jmpsec github.com/jmpsec/osctrl CVEs

Newest publication first

1. CVE-2026-28280 `osctrl-admin` has Stored Cross-Site Scripting (XSS) in On-Demand Query List

   Published 2026-02-26

   High·CVSS 8.7

   osctrl is an osquery management solution. Prior to version 0.5.0, a stored cross-site scripting (XSS) vulnerability exists in the osctrl-admin on-demand query list. A user with query-level permissions can inject arbitrary JavaScript via the query parameter when running an on-dema...

2. CVE-2026-28279 `osctrl-admin` Vulnerable to OS Command Injection via Environment Configuration

   Published 2026-02-26

   High·CVSS 8.4

   osctrl is an osquery management solution. Prior to version 0.5.0, an OS command injection vulnerability exists in the osctrl-admin environment configuration. An authenticated administrator can inject arbitrary shell commands via the hostname parameter when creating or editing env...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.