CVE-2026-85453: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in themoos core-moos

Themoos core-moos through version 10.4.0 does not properly neutralize input when generating web pages for MOOSDB HTTP interfaces. This improper escaping of database contents enables attackers who have MOOS publisher privileges to embed malicious script payloads in variable values. When operators access the web interface, these scripts execute in their browsers, constituting a stored cross-site scripting vulnerability. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction needed, and low impact on confidentiality, integrity, and availability.

Attackers with MOOS publisher access can inject malicious scripts that execute in the browsers of operators viewing the MOOSDB web interface. This can lead to unauthorized actions performed in the context of the operator's session, potentially exposing sensitive information or enabling further attacks. The impact is limited by the requirement of publisher privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict MOOS publisher privileges to trusted users only and consider limiting access to the MOOSDB web interface to reduce exposure.