OSC ondemand, an open-source high-performance computing portal, contains a cross-site scripting vulnerability identified as CVE-2026-44371. This vulnerability is due to improper neutralization of input when generating web pages, specifically allowing execution of JavaScript through specially crafted filenames in the file browser interface. Versions affected include all releases prior to 4.0.11, versions from 4.1.0 up to but not including 4.1.5, and versions from 4.2.0 up to but not including 4.2.2. The issue is resolved in versions 4.0.11, 4.1.5, and 4.2.2. The CVSS 4.0 vector indicates the attack is network-based, requires no privileges, and involves user interaction, with low complexity and low scope impact.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected user's browser via the file browser component. This can lead to potential session hijacking, information disclosure, or other client-side impacts typical of XSS vulnerabilities. The vulnerability does not require authentication or privileges to exploit and can be triggered remotely over the network. However, user interaction is required to trigger the malicious script.

The vulnerability is fixed in OSC ondemand versions 4.0.11, 4.1.5, and 4.2.2. Users should upgrade to one of these versions or later to remediate the issue. Since the vendor advisory does not provide additional remediation details or temporary mitigations, upgrading is the recommended action. Patch status is confirmed by the vendor's versioning information.