CVE-2024-48937

What it actually does

Allows arbitrary JavaScript execution when the short description of the SLA field in Activity Dialogues is rendered, due to insufficient sanitization of user-controlled content.

Why it matters to the business

Attackers could hijack user sessions, perform unauthorized actions, or exfiltrate data within the affected system, increasing risk of account compromise and operational disruption; the issue affects a widely used package with downstream dependents.

How an attack unfolds

An attacker supplies a crafted JavaScript payload in the SLA short description field; when another user opens the associated Activity Dialogue the payload executes in the victim's browser context, enabling session theft or actions on the user's behalf.

How to fix it

Upgrade github.com/hashicorp/nomad (Go) to version 1.5.14 or later; apply vendor patches promptly given the 731 days since publication and slight EPSS increase.

How to confirm the fix worked

Confirm the installed package version meets or exceeds the fixed release, then verify that previously injectable script content no longer executes by testing the SLA short description field.

Typical attack path

1. Identify an editable SLA short description field in an Activity Dialogue
2. Inject a malicious script payload into the field
3. Trigger a victim user to view or interact with the dialogue
4. Script executes to steal session tokens or perform privileged actions

How to detect it

Inspect web server and application logs for requests that include script tags or event handlers in SLA-related parameters; look for unexpected outbound requests or cookie exfiltration originating from dialogue view endpoints.

What your security team should do

• Prioritize upgrade to the fixed version across all instances
• Review and sanitize existing SLA field data for embedded scripts
• Enable web application firewall rules that block common XSS patterns until patches are applied
• Monitor authentication and session activity for anomalies