Proxmox CVE

Missing validation of xterm.js URL parameters

PSA-2026-00075-1 PVE

Affected packages

pve-xtermjs

Details

Missing validation of URL parameters in the xterm.js console page allows an attacker to trigger almost arbitrary POST requests as another user, if they can trick them into opening a malicious crafted link.

This issue was found internally.

Fixed in

  • pve-xtermjs >= 6.0.0-3

This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.