CVE-2026-37710: n/a

CVE-2026-37710 is a Cross Site Scripting (CWE-79) vulnerability affecting Omeka S version 4.2.0. It allows remote attackers to execute arbitrary code by exploiting the site navigation custom URL function. The vulnerability has a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating that it can be exploited remotely with low attack complexity and no privileges, but requires user interaction. The vulnerability impacts confidentiality and integrity but not availability. There is no information about available patches or fixes.

The vulnerability allows remote attackers to execute arbitrary code via Cross Site Scripting, potentially leading to partial compromise of confidentiality and integrity of the affected system. It does not impact availability. Exploitation requires user interaction and can be performed without privileges. No known active exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input in the site navigation custom URL function and consider applying any available workarounds recommended by the vendor.