EUVD-2026-30556
GHSA-ch4j-vcf5-58x5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in the Set field type's Display template option, where the template string is processed by the $interpolate function using new Function() and rendered via Vue's v-html directive without sanitization. An attacker with content/:models/manage permission can inject arbitrary JavaScript into the Display template, which executes in the browser of any user viewing the collection items list.
AnalysisAI
Stored cross-site scripting in Cockpit CMS 2.14.0 and earlier allows authenticated users with content/:models/manage permission to inject arbitrary JavaScript through the Set field type's Display template option. The vulnerability exploits unsafe template rendering via new Function() and Vue's v-html directive without sanitization, executing injected code in the browsers of all users viewing the collection items list. Vendor-released patch available via commit 72a83fc replaces Function-based evaluation with sandboxed JSLite execution.
Technical ContextAI
Cockpit CMS (cpe:2.3:a:cockpit-hq:cockpit) is a headless CMS built on PHP with Vue.js frontend components. The vulnerability exists in the Set field type's Display template feature, which processes user-supplied template strings through App.utils.$interpolate using JavaScript's new Function() constructor for dynamic code generation, then renders the result via Vue's v-html directive. This pattern (CWE-79: Improper Neutralization of Input During Web Page Generation) creates a classic stored XSS vector where template syntax becomes executable JavaScript. The patch commit replaces the Function-based interpolation with sandboxed JSLite execution to eliminate arbitrary code execution while preserving legitimate template behavior.
RemediationAI
Upgrade to Cockpit CMS post-2.14.0 versions incorporating commit 72a83fc or later from the main branch at https://github.com/Cockpit-HQ/Cockpit/commit/72a83fcfe85ad8330e9ae834bc02fa517b5749e9. The patch replaces Function-based template interpolation with sandboxed JSLite execution, eliminating the code injection vector while maintaining display template functionality. If immediate patching is not feasible, implement strict role-based access control to restrict content/:models/manage permission to only highly trusted administrators, reducing the attacker pool. As a compensating control, audit existing Set field Display templates for suspicious JavaScript patterns and sanitize or remove them, though this does not prevent future injection. Consider implementing Content Security Policy (CSP) headers to restrict inline script execution, which may limit XSS payload effectiveness but could also break legitimate Cockpit CMS frontend functionality and requires thorough testing. Review application logs for unexpected changes to Set field configurations as potential indicators of exploitation attempts.
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. Rated critical
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. Rated critical severit
Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0. Rated critical severity (CVSS 9.
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. Rated critical s
Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse t
SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to r
PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3. Rated high severity (CVSS 8.8), this v
A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Admi
Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1. Rated high sever
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8. Rated high severity (CVSS 8.8), this vulnerab
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.
Authenticated remote code execution in Cockpit CMS lets attackers holding collection-management privileges inject arbitr
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today