CVE-2026-23929

EUVD-2026-60734
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain.
Prototype Pollution
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
ZabbixCNA
8.5 HIGH
NETWORK
LOW
LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
zabbixzabbix
6.0.44 ≤
𝑥
≤ 6.0.45
CNA
zabbixzabbix
7.0.22 ≤
𝑥
≤ 7.0.24
CNA
zabbixzabbix
7.4.6 ≤
𝑥
≤ 7.4.8
CNA
Common Weakness Enumeration
References
https://support.zabbix.com/browse/ZBX-28068