CVE-2026-126771

CVSS 5.4 (medium) · published 2026-11-11

OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts by uploading attachments with spoofed text/html Content-Type. Attackers can upload HTML files named like test.html.pdf that render in the REMS origin via Preview, executing JavaScript in victims' browsers.

Weakness: CWE-79

Source: NVD CVE-2026-126771

References

• https://gist.github.com/neelkotnis/ddf75e2cb7192180e6c9618d27d1e99b
• https://opstree.com/rems-ai-powered-observability/
• https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-stored-xss-via-attachment-upload-and-preview

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.