Threats affecting pkg:github/jeromedevome/GRR

CVE-2026-58257 is a path traversal vulnerability in JeromeDevome GRR prior to version 4.5.0. The flaw exists in the database restoration feature, which does not properly validate file paths. An administrator user can exploit this to read or delete arbitrary files on the server, potentially disclosing sensitive information or causing denial of service. The risk is higher if the server runs with elevated privileges. This issue is fixed in version 4.5.0.

CVE-2026-58256 is a critical code injection vulnerability in JeromeDevome's GRR resource management application. Before version 4.5.0, an administrator could inject malicious PHP code via LDAP connector configuration parameters, leading to remote code execution. Exploitation requires the administrator to connect to an attacker-controlled LDAP server and submit crafted input. The vulnerability is fixed in version 4.5.0.

JeromeDevome GRR versions prior to 4.5.0 contain a reflected cross-site scripting (XSS) vulnerability in the maj.php script. This occurs when the forcemaj parameter is reflected without proper escaping if installation files remain accessible. An attacker can exploit this by crafting a URL that executes arbitrary JavaScript in a victim's browser, potentially leading to phishing, redirection to malicious sites, cookie theft, and session hijacking due to the authentication cookie not being HttpOnly. The vulnerability is fixed in version 4.5.0.