CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2026-44903

Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.

Score
5.1 medium
Published
2026-05-26
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
net-mgmt/prometheus2prometheus2.55.1_20unaddresseddor.bsd@xm0.uk

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>prometheus</name>
	<range><lt>3.5.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Prometheus is an open-source monitoring system and time series
	database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus
	server's legacy web UI (enabled via the command-line flag
	--enable-feature=old-ui), the histogram heatmap chart view does not
	escape le label values when inserting them into the HTML for use as
	axis tick mark labels. An attacker who can inject crafted metrics can
	execute JavaScript in the browser of any Prometheus user who views the
	metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3
	and 3.11.3.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-44903</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-44903</url>
    </references>
    <dates>
      <discovery>2026-05-26</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>