GitHub Advisoryadvisory · Packagist

GHSA-ch4j-vcf5-58x5 Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option

MEDIUM Published 2026-05-15 Modified 2026-05-21 Official page ↗
Aliases
CVE-2026-23695
Ecosystem
Packagist
Packages
cockpit-hq/cockpit
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-05-21

Affected packages

• Packagist cockpit-hq/cockpit: <= 2.14.0 (no fix yet)

Description

Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in the Set field type's Display template option, where the template string is processed by the $interpolate function using new Function() and rendered via Vue's v-html directive without sanitization. An attacker with content/:models/manage permission can inject arbitrary JavaScript into the Display template, which executes in the browser of any user viewing the collection items list.

Related

Alias · CVE (1)

  • CVE-2026-23695 Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in the Set field type's… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References