CVE-2026-49131 is a stored cross-site scripting vulnerability in Deciso B.V.'s OPNsense firewall software versions prior to 26.1.9. The flaw arises because the firewall rule description field accepts input that is not properly sanitized. Attackers with authenticated access and firewall rule management privileges can embed malicious HTML or JavaScript payloads via the filter API endpoint. These payloads are persisted and rendered using the default cell formatter in opnsense_bootgrid.js, which assigns raw content to innerHTML, enabling script execution in the context of any authenticated user who views the Firewall Rules page.

This vulnerability allows attackers with certain privileges to execute arbitrary scripts in the browsers of other authenticated users. The impact includes potential session hijacking and credential theft. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, no required user interaction, and limited scope and impact confined to confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor Deciso B.V.'s advisories for updates. Until a patch is available, restrict firewall rule management privileges to trusted users only and avoid viewing the Firewall Rules page in untrusted environments.