Omnispace Agora Project Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the Omnispace Agora Project, affecting versions prior to 25.10. This vulnerability allows attackers to execute arbitrary code by injecting malicious scripts into the notify parameter of the file controller, which is used for error display.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the file controller's notify parameter with a script payload. The injected script will be executed in the browser of the user viewing the error notification.

Remediation

Users can update to Omnispace Agora Project version 25.10 or later to address this vulnerability.