pfSense

In the future, please submit security concerns privately via the process documented at https://www.netgate.com/security

Updated subject/description to match observed behavior. Keeping public for now since it was submitted publicly.

I was able to confirm a problem here but the screenshot at the linked URL is weird in that the URL and XSS dialog in the screenshot are from interfaces_groups.php but that does not match the rest of the content in the screenshot background which is from interfaces_groups_edit.php. Might be a browser quirk or how the screenshot was created, but it's still odd. There isn't any way I could find that resulted in an XSS dialog on interfaces_groups_edit.php directly with the error message shown in the screenshot about the group already existing. The XSS appeared on interfaces_groups.php where it prints the member list, which matches the URL in the screenshot.

Applied in changeset 9a843098cf3f28c27c3e615c4c788c84bd29df6f.

Seems to be working properly on save and load in current builds.