CVE-2026-85453: MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scripting
Published Sep 3, 2026
·Updated
MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing attackers to inject malicious scripts. Any MOOS publisher can set variable values containing script payloads that execute in the browser of operators viewing the web interface.
Affected Software
2 affected components
MOOS core-moos<=10.4.0
MOOSDB<=10.4.0
Event History
Sep 3, 2026
CVE Published
via MITRE·10:38 PM
Data Sourced
via MITRE·10:38 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What interaction is necessary for a stored payload to execute?
A MOOS publisher must first set a variable value containing a script payload. The payload executes when an operator views the affected MOOSDB HTTP page in a browser.
2
Which users are directly exposed to the browser-side impact?
Operators who view the MOOSDB web interface are directly exposed, because the unescaped database content is rendered in their browser.