{"id":"CVE-2026-60119","summary":"Hi.Events \u003c 1.11.0 XSS via Event Title JSON.stringify Injection","details":"Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the \u003c/script\u003e sequence, which is not escaped by JSON.stringify() when embedded in inline script tags. Attackers can craft an event title that breaks out of the script context in the application/ld+json structured data block or server-side rehydrated state, causing the payload to execute in the browser of any user who views the public event page, including unauthenticated visitors and authenticated administrators.","aliases":["GHSA-2ggx-79g6-2jmj"],"modified":"2026-07-17T03:41:58.638157407Z","published":"2026-07-14T15:44:34.636Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60119.json","unresolved_ranges":[{"extracted_events":[{"fixed":"1.11.0"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"fixed":"1.11.0"}],"source":"CPE_FIELD"},{"extracted_events":[{"introduced":"Hi.Events"},{"fixed":"1.11.0"}],"source":"DESCRIPTION"}],"cna_assigner":"VulnCheck","cwe_ids":["CWE-862"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60119.json"},{"type":"ADVISORY","url":"https://github.com/HiEventsDev/Hi.Events/releases/tag/v.1.11.0-beta"},{"type":"ADVISORY","url":"https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2ggx-79g6-2jmj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60119"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/hi-events-beta-xss-via-event-title-json-stringify-injection"},{"type":"REPORT","url":"https://github.com/HiEventsDev/Hi.Events/pull/1260"},{"type":"FIX","url":"https://github.com/HiEventsDev/Hi.Events/commit/1e36b070771801ed7113255ef7b3a7f271a2a794"},{"type":"PACKAGE","url":"https://github.com/HiEventsDev/Hi.Events"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hieventsdev/hi.events","events":[{"introduced":"0"},{"fixed":"1e36b070771801ed7113255ef7b3a7f271a2a794"},{"fixed":"8da9feedc984ce8330e5c84f87c5654536b1e28f"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v.1.10.0-beta","v1.9.0-beta","v1.8.0-beta","v1.7.1-beta","v1.7.0-beta","v1.6.0-beta.1","v1.5.1-beta.1","v1.5.0-beta.1","v1.4.0-beta.1","v1.3.0-beta.1","v1.2.0-beta.1","v1.1.0-beta.2","v1.1.0-beta.1","v1.1.0-alpha.2","v1.1.0-alpha.1","v1.0.0-beta.6","v1.0.0-beta.5","v1.0.0-beta.4","v1.0.0-beta.3","v1.0.0-beta.2","v1.0.0-beta.1","v1.0.0-alpha.17","v1.0.0-alpha.16","v1.0.0-alpha.15","v1.0.0-alpha.14","v1.0.0-alpha.13","v1.0.0-alpha.12","v1.0.0-alpha.11","v1.0.0-alpha.10","v1.0.0-alpha.9","v1.0.0-alpha.8","v1.0.0-alpha.7","v1.0.0-alpha.6","v1.0.0-alpha.5","v0.8.0-beta.9","v0.8.0-beta.8","v0.8.0-beta.7","v0.8.0-beta.6","v0.8.0-beta.5","v0.8.0-beta.4","v0.8.0-beta.3","v0.8.0-beta.2","v0.8.0-beta.1","v0.7.0-beta.6","v0.7.0-beta.5","v0.7.0-beta.4","v0.7.0-beta.3","v0.7.0-beta.2","v0.7.0-beta.1","v0.7.0-alpha.3","v0.7.0-alpha.2","v0.7.0-alpha.1","v0.6.0-alpha.3","v0.6.0-alpha.2","v0.6.0-alpha.1","v0.5.0-alpha.2","v0.5.0-alpha.1","v0.4.0-alpha.2","v0.4.0-alpha.1","v0.3.0-alpha.3","v0.3.0-alpha.2","v0.3.0-alpha.1","v0.2.0-alpha.3","v0.2.0-alpha.2","v0.2.0-alpha.1","v0.1.0-alpha.17","v0.1.0-alpha.16","v0.1.0-alpha.15","v0.1.0-alpha.14","v0.1.0-alpha.13","v0.1.0-alpha.12","v0.1.0-alpha.11","v0.1.0-alpha.10","v0.1.0-alpha.9","v0.1.0-alpha.8","v0.1.0-alpha.6","v0.1.0-alpha.5","v0.1.0-alpha.4","v0.1.0-alpha.3","v0.1.0-alpha.2","v0.1.0-alpha.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-60119.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}