The vulnerability is a type of cross‑site scripting that exists in the pfBlockerNG component of Netgate pfSense version 26.03.1‑RELEASE. An attacker who can supply malicious input to the configuration interface may be able to inject executable script that runs in the context of the pfSense web administration console, leading to arbitrary code execution on the appliance and giving the attacker full control.

Affected product is Netgate pfSense, release 26.03.1‑RELEASE, specifically the pfBlockerNG package used for DNS filtering and blocking. Any installations running this version and its bundled pfBlockerNG are at risk unless the component is updated or removed.

Now a CVSS score of 6.1 is provided, placing the vulnerability in the medium severity range. The EPSS score is not available, indicating no publicly reported exploitation likelihood at this time, and it is not listed in the CISA KEV catalog. The vulnerability stems from an unsanitized input that allows the injection of malicious JavaScript into the pfSense web administration console. The attack likely requires access to the pfSense web UI or a trusted user account, but the injected payload can be used to execute arbitrary commands on the underlying operating system, providing the attacker with full control.