Hi.Events EUVD-2026-43742

The vulnerability stems from unsafe embedding of user-controlled data into HTML-context inline script blocks. Hi.Events serializes event metadata - including the event title - using JSON.stringify() into either an application/ld+json structured data block or a server-side rehydrated JavaScript state object rendered directly in the HTML response. Although JSON.stringify() produces valid JSON, it does not encode the string '</script>' in a way that is safe for HTML embedding; the browser's HTML parser terminates the script block at the literal '</script>' sequence regardless of its position within a JSON string value. An attacker crafts a title such as '</script><script>malicious_code()</script>' to break out of the script context and inject executable HTML. The CPE string cpe:2.3:a:hieventsdev:hi.events:*:*:*:*:*:*:*:* confirms all versions through the fix are affected. The assigned CWE-862 (Missing Authorization) is atypical for this injection class - CWE-79 (Improper Neutralization of Input During Web Page Generation) or CWE-116 (Improper Encoding or Escaping of Output) would more precisely describe the root cause. The CWE-862 framing likely reflects that a low-privileged event creator can exercise cross-user impact against administrators without proper authorization boundary enforcement.