Bug 2509504 (CVE-2026-66807) - CVE-2026-66807 console: dangerouslySetInnerHTML with unescaped subscription identifiers in SharedResourceWarning
Summary: CVE-2026-66807 console: dangerouslySetInnerHTML with unescaped subscription i...
Keywords:
Status: NEW
Alias: CVE-2026-66807
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-30 15:44 UTC by OSIDB Bzimport
Modified: 2026-09-01 18:28 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-30 15:44:43 UTC 
The getCodeSpan helper in SharedResourceWarning.js constructs an HTML string via string concatenation: `getCodeSpan = (text) => '<span class="code-font">' + text + '</span>'` with no HTML encoding. The result is rendered via React's dangerouslySetInnerHTML with `deployingSubscription`, which is a Subscription metadata.name value.

Kubernetes DNS-1123 name validation ([a-z0-9.-]) currently prevents injection of HTML metacharacters (<>"'), so this is not exploitable today. However, the dangerous sink is one upstream data-source change away from XSS — any relaxation of the name validation or alternative data source feeding text into getCodeSpan would enable stored XSS in the hub console.

Affected file: frontend/src/routes/Applications/CreateApplication/Subscription/components/SharedResourceWarning.js (lines 85-87, 191-216)

Fix: Use `<Trans>` from react-i18next with React children instead of dangerouslySetInnerHTML, or HTML-encode `text` in getCodeSpan.

Fix branch: glasswing/f009
Engineering contact: Kevin Cormier
Jira: ACM-38694

Discovered by: Project Glasswing AI-SAST campaign (HP Mythos)
Note You need to log in before you can comment on or make changes to this bug.