CVE-2026-56128: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Netgate pfSense Plus

This vulnerability affects pfSense Plus versions before 26.07 and pfSense CE versions before 2.9.0. An authenticated user with the Firewall: Schedules: Edit privilege can inject JavaScript code through the 'descr' parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and later inserted into an HTML attribute in /firewall_rules.php with only single-quote escaping, enabling an attacker to break out of the attribute context using double quotes. The malicious script executes in the browser of any user who has the Firewall: Rules privilege and views the rules list containing the affected schedule, leading to potential cross-site scripting attacks.

The vulnerability allows authenticated users with limited privileges to inject and execute arbitrary JavaScript in the browsers of users with Firewall: Rules privilege. This could lead to session hijacking, unauthorized actions, or other attacks within the context of the affected users' sessions. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the Firewall: Schedules: Edit and Firewall: Rules privileges to trusted users only to reduce risk. Monitor vendor communications for updates on patches or official mitigations.