CVE-2026-34416 is a reflected cross-site scripting vulnerability in OSCAL-GUI by brian-ruf. It occurs due to improper neutralization of input during web page generation, specifically via the project request parameter. Attackers can craft URLs with malicious input that breaks out of JavaScript string and HTML attribute contexts in the body onload event handler, leading to arbitrary script execution in the victim's browser. The vulnerability is exploitable without authentication and has a medium CVSS 4.0 score of 5.1. No official remediation or patch information is provided in the available data.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser session when the victim visits a maliciously crafted URL. This can lead to typical XSS impacts such as session hijacking, defacement, or redirection to malicious sites. However, no known exploits in the wild are reported, and the vulnerability requires user interaction (visiting the malicious URL).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on untrusted links involving the OSCAL-GUI product. Vendors and users should monitor for updates or patches addressing this vulnerability.