CVE-2026-34417 is a reflected cross-site scripting vulnerability in brian-ruf's OSCAL-GUI product. The issue occurs in oscal-forms.php where the project request parameter is URL-decoded and assigned to the project_id variable without proper sanitization. When the project ID is not found, the unsanitized value is concatenated into an error message via the Messages() function and reflected in the HTML response body without encoding. This allows unauthenticated attackers to execute arbitrary JavaScript in the victim's browser by injecting malicious content through the project parameter. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity). No patch or official remediation has been disclosed, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the victim's browser when they visit a crafted URL containing malicious input in the project parameter. This can lead to typical XSS impacts such as session hijacking, defacement, or redirection to malicious sites. However, the vulnerability requires user interaction (UI:A) and does not provide direct access or elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the project parameter to prevent injection. Additionally, restricting access or monitoring for suspicious URL parameters may help reduce risk. No vendor advisory or patch links are currently provided.