The OSCAL-GUI product by brian-ruf is affected by a reflected cross-site scripting vulnerability identified as CVE-2026-34417. The issue occurs because the project request parameter in oscal-forms.php is URL-decoded and assigned to the project_id variable without any sanitization in oscal-functions.php. When the project ID is not found, the unsanitized value is concatenated into an error message via the Messages() function and reflected directly into the HTML response body without proper encoding. This allows unauthenticated attackers to inject arbitrary JavaScript code that executes in the context of a victim's browser. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. There is no vendor advisory or patch information available, and no known exploits have been reported.

Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary JavaScript in the victim's browser. This can lead to typical XSS impacts such as session hijacking, defacement, or redirection to malicious sites. However, the vulnerability requires user interaction (UI:A) and does not grant attacker privileges or access to the underlying system. The medium CVSS score reflects these factors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and output encoding for the project request parameter to prevent injection of malicious scripts. Additionally, applying web application firewalls (WAFs) that detect and block reflected XSS payloads may provide temporary mitigation.