CVE-2026-23929
Description
A flaw was found in Zabbix. This prototype pollution vulnerability, specifically within the searchParamsToObject() function, allows an attacker to inject malicious data into web pages. By manipulating URL parameters that are not properly filtered, an attacker can achieve persistent Cross-Site Scripting (XSS) in the Maps feature. This could lead to unauthorized execution of scripts in a user's browser, potentially compromising user sessions or disclosing sensitive information.
Statement
Red Hat rates this vulnerability as Important because an authenticated remote attacker can store arbitrary script payloads within the web interface, which execute in the context of other users and can compromise administrative sessions. Although persistent script injection presents a significant risk to application integrity, Zabbix is not included in Red Hat Enterprise Linux or any supported Red Hat enterprise offerings and is only distributed via community repositories such as Fedora.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
