CVE-2026-44371
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Open OnDemand (an HPC portal) before versions 4.0.11, 4.1.5, and 4.2.2 allows specially crafted filenames to execute JavaScript in the file browser. Fixed in 4.0.11, 4.1.5, and 4.2.2.
Risk Assessment
An attacker could place a malicious filename that executes JavaScript in the user's context when browsed, potentially leading to session theft or actions performed on behalf of the user.
Recommendation
Update Open OnDemand to version 4.0.11, 4.1.5, or 4.2.2 (or later) and inform users about the risk of untrusted filenames.
Other vulnerabilities in Open OnDemand
See all- CVE-2025-64185Medium
Open OnDemand, an HPC portal, in versions prior to 4.0.8 and 3.1.16 creates world-writable locations in the GEM_PATH, potentially allowing unauthorized modifications.
- CVE-2025-62724Medium
Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a Time of Check to Time of Use (TOCTOU) attack when downloading zip files to access files outside of the OOD_ALLOWLIST. Files accessed are still protected by UNIX permissions.
Original NVD description (English source)
Open OnDemand is an open-source high-performance computing portal. Prior to 4.0.11, 4.1.5, and 4.2.2, specially crafted filenames can execute javascript in the file browser This vulnerability is fixed in 4.0.11, 4.1.5, and 4.2.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS