CVE-2026-58391: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in opnsense core

OPNsense core versions before 26.1.11 improperly neutralize input when rendering stored category names and alias descriptions in HTML title attributes in filter_rule.volt and nat_rule.volt templates. The response layer uses ENT_NOQUOTES encoding, allowing double quotes to close the attribute early and inject event-handler attributes into spans. An attacker with Firewall Categories or Firewall Alias Edit privileges can store malicious input that executes script in the session of an administrator or user who opens the affected Rules or NAT page. This script can access CSRF tokens and perform authenticated actions on behalf of the victim. The vulnerability is addressed in OPNsense version 26.1.11.

An attacker with edit privileges on Firewall Categories or Firewall Aliases can inject malicious scripts that execute in the context of an administrator or other user viewing firewall or NAT rules. This can lead to theft of CSRF tokens and unauthorized authenticated actions, potentially compromising the integrity of firewall configurations. The vulnerability does not allow direct denial of service or system-level compromise but can facilitate unauthorized configuration changes.

This vulnerability is fixed in OPNsense version 26.1.11. Users should upgrade to version 26.1.11 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.