EUVD-2026-53370
GHSA-pf4v-rpp4-fp6r
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Admin credentials required to configure siteId (PR:H); stored XSS crosses scope to victim browsers (S:C/UI:R); cookie theft and DOM takeover justify C:H/I:H; no availability impact.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo siteId value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page: _paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);. The escaping pipeline used (jsesc with isScriptContext:true, then html-escaper.escape()) does not escape the characters ], ), ;, (, which are sufficient to break out of the array/push expression context. A siteId value such as 1]);alert(document.cookie)//, once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.
AnalysisAI
Stored cross-site scripting in Uptime Kuma's Matomo analytics integration allows an admin or editor-level user to inject arbitrary JavaScript into every public status page by saving a crafted siteId value. The escaping pipeline in server/analytics/matomo-analytics.js - combining jsesc with isScriptContext:true and html-escaper.escape() - fails to neutralize JavaScript syntax characters (], ), ;, (), which are sufficient to break out of the _paq.push(['setSiteId', ...]) expression context. Every unauthenticated visitor of any /status/<slug> page subsequently executes the attacker-controlled JavaScript, enabling session cookie theft and full page takeover. No public exploit has been independently confirmed, though the disclosure includes a functional proof-of-concept payload; no KEV listing exists at time of analysis.
Technical ContextAI
Uptime Kuma (cpe:2.3:a:louislam:uptime-kuma:*:*:*:*:*:*:*:*) is a self-hosted, open-source uptime monitoring tool. Its Matomo analytics integration (server/analytics/matomo-analytics.js) renders the admin-configured siteId directly into a <script> block via template literal: _paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);. The escaping pipeline applies jsesc (configured for script context) followed by html-escaper.escape(), which together neutralize HTML-special characters and some Unicode sequences but leave JavaScript punctuation - specifically ], ), ;, and ( - unescaped. Because siteId is placed inside a JavaScript array-push expression without numeric type enforcement or JSON encoding, these unescaped characters are sufficient to terminate the enclosing array literal and function call, then inject arbitrary statements. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) rooted in an inadequate escaping strategy for a JavaScript inline-script context, compounded by the absence of input validation enforcing that siteId must be a numeric integer.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis - available references point only to the upstream project repository (https://github.com/louislam/uptime-kuma) and the vulnerable source file, with no tagged release or advisory confirming a fix. As an immediate compensating control, administrators should disable the Matomo analytics integration entirely within Uptime Kuma settings, removing the injection surface with no impact on core monitoring, alerting, or status page functionality. If Matomo integration is operationally required, access to the Uptime Kuma administrative panel should be restricted at the network layer (firewall rules, reverse-proxy authentication, VPN requirement) to the smallest possible set of trusted principals, reducing the pool of accounts capable of saving a malicious siteId - though this does not eliminate insider threat. The correct long-term fix requires enforcing that siteId is a valid positive integer at the server-side before template injection, or replacing the current escaping pipeline with strict JSON encoding (e.g., JSON.stringify(siteId)) to ensure the value is always treated as a JavaScript string or number literal with no context-breakout potential.
More in Uptime Kuma
View allUptime Kuma is an easy-to-use self-hosted monitoring tool. Rated high severity (CVSS 8.8), this vulnerability is remotel
Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in
Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Rated high s
Uptime Kuma is a self-hosted monitoring tool. Rated high severity (CVSS 7.8), this vulnerability is low attack complexit
Uptime Kuma is an open source self-hosted monitoring tool. Rated medium severity (CVSS 6.1), this vulnerability is remot
Uptime Kuma is a self-hosted monitoring tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitab
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Rated high severity (CVSS 7.8), this vulnerability is low att
Uptime Kuma versions 1.23.0 through 2.2.0 contain an incomplete Server-Side Template Injection (SSTI) vulnerability in t
Cross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execu
Uptime Kuma is a self-hosted monitoring tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitab
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today