Skip to content
OpenAdvisories

Package · Go

github.com/jmpsec/osctrl

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.1
    CVE-2026-28280

    `osctrl-admin` has Stored Cross-Site Scripting (XSS) in On-Demand Query List

    osctrl is an osquery management solution. Prior to version 0.5.0, a stored cross-site scripting (XSS) vulnerability exists in the `osctrl-admin` on-demand query list. A user with query-level permissions can inject arbitrary JavaScript via the query parameter …

    jmpsec osctrl github.com/jmpsec/osctrl Go
  • High 7.4
    CVE-2026-28279

    `osctrl-admin` Vulnerable to OS Command Injection via Environment Configuration

    osctrl is an osquery management solution. Prior to version 0.5.0, an OS command injection vulnerability exists in the `osctrl-admin` environment configuration. An authenticated administrator can inject arbitrary shell commands via the hostname parameter when …

    jmpsec osctrl github.com/jmpsec/osctrl Go