CVE-2026-56127: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Netgate pfSense Plus

The vulnerability CVE-2026-56127 involves improper neutralization of input during web page generation in Netgate pfSense Plus and pfSense CE. Authenticated users who have the Firewall: Rules: Edit privilege can inject arbitrary JavaScript code through the descr parameter on the /firewall_rules_edit.php page. The description is stored in the pfSense XML configuration with only backslash escaping and no HTML sanitization. When the firewall log table is viewed on /status_logs_filter.php by users with the Status: Logs: Firewall privilege, the malicious script executes in their browsers. This cross-site scripting vulnerability could allow script execution in the context of the victim's browser session.

Successful exploitation allows an authenticated user with limited privileges to inject and execute arbitrary JavaScript code in the browsers of users who view firewall logs and have the Status: Logs: Firewall privilege. This could lead to session hijacking, unauthorized actions, or information disclosure within the context of the affected user's session. The impact is limited by the need for authenticated access and specific privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to users with Firewall: Rules: Edit and Status: Logs: Firewall privileges to trusted personnel only. Monitor vendor communications for updates regarding patches or official mitigations.