Technical impact
This CVE exposes a stored cross‑site scripting flaw in OPNsense’s firewall rule description field. The vulnerable code stores user input without validation and later renders it via the bootgrid.js cell formatter, which assigns raw content to innerHTML. When a malicious payload is injected, any authenticated user who opens the Firewall Rules page will have the malicious script executed in their browser, potentially allowing session hijacking or credential theft. The weakness is a classic XSS flaw (CWE‑79).
Affected Systems
OPNsense versions released before 26.1.9 from Deciso B.V. are affected. The issue exists for all users with firewall rule management privileges; the injected script can affect any authenticated user who views the Firewalls page.
Risk and Exploitability
The CVSS score of 5.1 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with firewall rule editing rights, and the attacker can deliver the payload through the filter API endpoint. Once stored, the script runs automatically for any authenticated UI viewer, providing an easy attack path for insiders or compromised accounts.
