The vulnerability arises when user‑supplied category names or alias descriptions are inserted into HTML title attributes without proper quote‑escaping, allowing an attacker with the ability to edit firewall rules to inject JavaScript. When a rule is displayed on the Firewall Rules or NAT page, the stored script executes in the browser session of any administrator or user who views the page, granting the attacker access to CSRF tokens and enabling the execution of authenticated actions as that user.

The flaw exists in the OPNsense core product prior to version 26.1.11. It affects users who have permissions to create or edit firewall categories or aliases and access the corresponding rules or NAT pages.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation under current conditions. The flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to first create a malicious category or alias and then rely on an administrator or privileged user to open the affected page, after which the attacker can perform privileged actions through CSRF tokens in the victim’s session. This restricts the attack vector to insiders or compromised accounts that can influence rule configuration, but once triggered the impact can mimic elevated privilege control.