CVE-2026-48552 is a DOM-based cross-site scripting vulnerability affecting Nagios Core prior to version 4.5.14 and Nagios XI prior to 2026R1.7. The issue occurs in the jsonquery.js script where JSON string values from stored fields are reflected into the DOM without encoding or sanitization, enabling attackers to inject and execute arbitrary JavaScript code in users' browsers. This vulnerability requires low attack complexity and no privileges but does require user interaction. The vulnerability has been publicly disclosed but no official fix or patch has been confirmed at this time.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, unauthorized actions on behalf of the user, or other malicious activities within the scope of the affected web application. The vulnerability does not require elevated privileges or authentication but does require user interaction to trigger the malicious script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected interfaces and applying any recommended workarounds from Nagios Enterprises. Monitor the vendor's advisories for updates on patches or mitigations.